Acceptable use policy

WebCheck is intended for legitimate website and service health monitoring. You must have permission to monitor every target you add. This policy explains prohibited uses and complements the Terms of service.

Use WebCheck only with permission

You may monitor a site, endpoint, hostname or TCP port only when you own it or have clear authorisation from the responsible operator. You are responsible for confirming that your checks comply with contracts, acceptable-use rules, robots or access policies that apply to the target, and with applicable law.

Do not use WebCheck to

• Probe, scan, enumerate or monitor systems without authorisation.
• Target private networks, loopback addresses, internal services, cloud metadata endpoints or access-controlled infrastructure.
• Evade rate limits, access controls, bot protections, WAF rules, CAPTCHA challenges or other security controls.
• Submit forms, place orders, create accounts, test credentials or perform authenticated browser journeys.
• Perform destructive actions, change data, trigger transactions or test vulnerabilities against a target.
• Generate abusive, excessive or deliberately disruptive traffic, or use checks as a denial-of-service mechanism.
• Store passwords, API keys, access tokens, payment data or unnecessary sensitive personal data in target URLs, labels, assertions or notification fields.
• Use WebCheck to distribute malware, phishing content, unlawful material, infringement or harassment.
• Misrepresent WebCheck results, status pages or widgets as a guarantee of service availability or security.
• Attempt to bypass WebCheck’s safety controls, usage limits, authentication, rate limits or delivery protections.

Safe monitoring configuration

• Prefer a lightweight, public health endpoint over a complex customer workflow.
• Choose a reasonable interval for the target and its rate-limit policy.
• Use narrow, stable content assertions and avoid dynamic or personal data.
• Keep webhook and messaging destinations under your control.
• Protect notification signing secrets and bot credentials, and rotate them if exposed.
• Review public status pages and widgets to ensure they disclose only intended information.

Safety controls

WebCheck validates destinations, resolves and revalidates network addresses, validates redirects, limits redirect depth and response size, and prevents unsafe HTTPS downgrade redirects. These controls are part of the service. A target that is blocked by them must not be made to work by weakening or circumventing the controls.

Responsibility for target impact

A check can still affect a target’s logs, rate limits, traffic costs or security systems. You are responsible for selecting targets and intervals that are proportionate to your authorisation and the target’s capacity. If an operator asks you to stop monitoring, stop or remove the target promptly.

Enforcement

We may reject configurations, disable checks, restrict accounts, revoke public tokens or preserve relevant operational evidence when misuse, a security risk, excessive traffic or a legal concern is detected. We may act without prior notice where immediate action is reasonably necessary to protect people, systems or the service.

Report a problem

Report suspected abuse, unsafe monitoring, exposed secrets or security issues through the NOTABIS account support channel. Include enough information to investigate, but do not include passwords, access tokens or other secrets. Do not use WebCheck to test whether a reported vulnerability can be exploited.

Changes

We may update this policy when WebCheck or applicable requirements change. The date above identifies the current published version. Continued use after an updated version is published means you accept the updated policy to the extent permitted by law.