Skip to main content

Getting Started

Running a FlawPilot scan takes under a minute. There is nothing to install and no account required for a standard scan.

Prerequisites​

  • A publicly reachable URL. FlawPilot only reads signals your site already exposes to the internet, so sites behind a VPN, basic auth, or an IP allowlist cannot be scanned.
  • Nothing else. No agent, no DNS change, no credentials.

Run your first scan​

  1. Go to flawpilot.com.
  2. Paste the URL you want to scan (for example https://example.com).
  3. Optionally narrow the scan to the categories you care about - Security, Performance, Infrastructure, or SEO.
  4. Start the scan and wait for the report. Most scans finish in seconds; performance checks take longer because several pages are measured.

What happens during a scan​

FlawPilot fetches your site the way any visitor or search-engine crawler would, then evaluates the responses:

  • Headers and TLS are read from the HTTP response and certificate chain.
  • DNS and email authentication records (SPF, DMARC, DKIM) are resolved publicly.
  • Performance is measured across 4–5 representative pages rather than the homepage alone, so a fast landing page can't mask a slow app.
  • Page content is parsed for metadata, structured data, and link/image hygiene.
Read-only by design

FlawPilot never attempts to log in, submit forms, exploit a vulnerability, or modify anything. Every check is passive and read-only.

Rescan after you ship a fix​

Findings are a snapshot of the moment the scan ran. After you deploy a fix, rescan the same URL and compare the report - the grade should move for the category you addressed. Allow time for CDN caches and DNS TTLs to expire before rescanning, or the scan may still observe the old configuration.

Next steps​

  • Learn what each category checks, and how the scores and risk bands are derived, in Scan Categories.