Login
Example/account/login
- Password
- Checkbox
No bot protection detected
Only a CSRF token. It keeps out other sites, not bots.
AssessmentHigh75/100
Bot check
Find your weak spots
before a bot attacks them.
Enter your website. We read your public pages and collect the attack surfaces on them. For each one we check whether it has bot protection that shows from the outside.
A scan runs 90 seconds at most - plus waiting time when others are running. Each weak spot shows up below as soon as we find it.
Result
This could be your result.
Three examples. After your scan, the weak spots we found show up here, including an assessment of your risk.
Contact form
Example/contact
- Text
- Text area
No bot protection detected
Only a honeypot field. Simple bots fall for it, targeted ones don't.
AssessmentLow28/100
Newsletter sign-up
ExampleFooteron every page (24)
- Checkbox
Protection detected: Google reCAPTCHA (v2 / v3 / Enterprise)
reCAPTCHA sends your visitors' data to Google in the US. In the EU that usually needs consent.
AssessmentInfo13/100
Limits
What we can't see from the outside.
The check is passive: it reads pages and forms and submits nothing. Rate limits and bot logic on your server leave no trace in the browser, so we don't see them. Heavily protected websites sometimes don't let our browser in at all, and then the result says exactly that. So "No bot protection detected" means we saw none from the outside.
FAQ
Questions about the bot check
What happens to my details?
We store your request: your name, company, email and the checked address. We store the result - the verdict and the forms we found - with it. Our team gets a summary. The result page stays available for 30 days. We delete the request and the result after four years, and your IP address after 12 months. The request only keeps a hash of it. With the second tick you agree that we may email you: about your result, about bot protection and fraud prevention, and about our products and offers. That's what you give in return for the free scan. You can withdraw at any time - via the unsubscribe link in every email or with a short note to info@vinishu.io.
Can I check other people's websites?
Only if you're allowed to - as the operator, as an agency on their behalf, or with permission. You confirm that with the first tick. The check is passive and only reads what any visitor sees. You still need the permission.
Do you submit anything?
No. Our browser loads pages and reads the forms. It fills in nothing, presses no submit button and tries no passwords. In your logs the scan looks like a visitor clicking quickly through your pages.
Why do you want my email address?
Every scan starts its own browsers on our servers. What you give us in return is the chance to contact you about your result. That's why the scan is free.
What does the number from 0 to 100 mean?
It's our assessment, not a standard. We give every form type a base weight - a login weighs more than a search. We multiply that by a factor for the protection we detect. The result falls into five bands: 0–14 Info, 15–34 Low, 35–59 Medium, 60–79 High, 80 and up Critical. The overall number follows the riskiest form. Each further form at 60 or above adds 4 points. If the website blocks automated browsers, we take off a fifth. With no form at all we set a fixed value: 12, or 8 if the website blocks automated browsers.
After the check
One request before you process. Your code decides.
With the Vinishu SDK, your backend checks every form request before it processes it. It doesn't replace a WAF. Write to us - we'll go through your result with you and tell you honestly whether the SDK fits.