Acceptable use policy

Skiplink loads pages on your instruction from our infrastructure. That makes what you point it at our problem as well as yours, which is why this policy is short, specific, and enforced.

Part of the terms of service. Last updated 29 July 2026.

Only scan what you are authorised to scan

The whole policy in one line. Concretely, you may scan:

a site you own or operate;
a site whose operator has given you permission — a client, for instance;
a genuinely public page, at a volume that could not be mistaken for a problem.

You must not use Skiplink to:

probe, enumerate or map infrastructure you do not control;
load any target repeatedly at a rate or volume that degrades it;
reach an internal service, a private network, a cloud metadata endpoint, or anything else not meant to be publicly reachable;
evade an access control, a paywall, a rate limit or a robots directive;
scan a page you have no legitimate interest in, in order to gather personal data from it;
form any part of an attack, a denial of service, or a security test you have not been engaged to perform.

We enforce the network part in code, not on trust

Every URL is resolved and checked before it is fetched, and refused if it points at loopback, a private range, link-local, carrier-grade NAT, unique-local addressing, or a cloud metadata address — including when those are reached through an IPv6 transition address or arrived at through a redirect. Separately, the machine that renders pages is firewalled so it cannot reach private address space at all.

So attempts at the third bullet above mostly fail rather than succeed. The policy exists for the rest, and because a control you can describe is one someone can hold you to.

Reports and content

Agency reports are white-label: your logo, your name, your colours. You must not use that to imply an endorsement, certification or audit that has not happened, and you must not remove or alter the paragraph on every report explaining what automated testing does and does not cover. There is no setting that removes it, and misrepresenting a scan as a conformance audit is a breach of this policy as well as, in several jurisdictions, of consumer protection law.

The service itself

You must not:

share, resell or sublicense API access except through the Agency plan, which exists for exactly that;
work around quotas or rate limits, including by opening multiple free accounts;
attempt to access another customer's data, or test our security without asking — we have a disclosure policy and we would rather hear from you than not;
use the free scanner as an unauthenticated API for something else. It is rate limited and capped for that reason.

What happens if you breach it

For the network and volume rules, we suspend first and ask afterwards, because the harm lands on somebody who is not a party to this agreement. For anything else we will contact you and give you a chance to put it right.

If you think we have suspended you wrongly, email hi@skiplink.dev — a person will read it and we will restore access if we got it wrong.

Reporting abuse

If Skiplink is being used against you, email hi@skiplink.dev with the timestamps and our user agent string from your logs, and we will identify and stop it. Our crawler identifies itself as Skiplink/1.0 with a link to skiplink.dev/bot.