Passive check only: reading public DNS records, Certificate Transparency logs and ordinary GET requests to the homepage over HTTPS and HTTP (plus, only if you choose “Check agent access”, up to three public metadata files) — exactly what any browser or mail server sees. No port scanning, intrusion attempts or changes of any kind are made to the scanned domain. Results are an indication and do not replace a professional security assessment.