About our scanner

Requests with the user agent PrimeDevForceSecurityCheck/0.1 (+https://primedevforce.com/bot) come from the Prime Dev Force Security Check, a free tool that checks a website's public security configuration. Someone entered your domain into it.

What a scan requests

  • GET https://<your domain>/ and GET http://<your domain>/, following at most 5 redirects
  • If your domain publishes an MTA-STS record: GET https://mta-sts.<your domain>/.well-known/mta-sts.txt
  • GET https://<your domain>/.well-known/security.txt, and /security.txt only if the first isn't there (reads at most 32 KiB)
  • DNS lookups (through Cloudflare's resolver, never your servers) of up to 4 other hosts your homepage loads scripts from. Those hosts receive no request from us.
  • Up to two TLS connection attempts to port 443: one offering TLS 1.2 (to read the certificate your server sends) and one offering at most TLS 1.1 (to see whether old versions are still accepted). Each is closed as soon as your server answers its first message. No handshake is completed and no data is sent.

That's at most about 17 requests to your site per scan. Scans are rate-limited. The scanner sends no form data, attack payloads or login attempts, and reads at most 512 KiB of the homepage.

Weekly checks for verified owners

If the owner of a domain has proved ownership and signed up for monitoring, the scanner also checks, once a week:

  • /robots.txt, which it follows. Our token is PrimeDevForceSecurityCheck; rules for * apply otherwise. If robots.txt can't be fetched because of a server error, no extra pages are requested.
  • Up to 5 pages on the same site where security matters most (for example sign-in, checkout and contact pages), one GET each.
  • Up to 10 subdomains found in public certificate logs or DNS, with the same homepage and TLS requests as a normal scan.

On each monitoring run (not only weekly), a verified owner's homepage also gets:

  • Two extra homepage requests for cloaking detection: one with the user agent Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot) PrimeDevForceSecurityCheck/0.1 (+https://primedevforce.com/bot), which still names us, and one with the referer https://www.google.com/, as a visitor from a search result would send.
  • GET /.git/HEAD, GET /.env and one random path (a baseline), without following redirects, reading at most 8 KiB each, to detect exposed deployment files. If .env is readable we keep only its variable names, never the values.

Redirects are followed as a browser would, at most 5 per request, and a few requests may run in parallel. Pages discovered for the weekly check are taken only from the verified domain.

Requests come from Cloudflare's network. If you want to report abuse, email security@primedevforce.com with the time of the requests.