How we protect your sites

Access

Deep scans connect with an SSH or SFTP key that you add and can remove at any time. Scans are read-only. Nothing is installed in WordPress.

Changes

Auto-Clean changes files only after you approve each fix. Removed files are moved to a quarantine folder on your own server, never deleted, and every change is logged so it can be restored.

Data

Connections and stored data are encrypted. Copies made during a scan are used only to produce your results and are deleted when the job closes. We never read or store customer payment data found on your site.

Payments

Payments are processed by Paddle. We never see or store your card details.

Report a vulnerability

If you find a security issue in CrawlXray, email support@crawlxray.com with "Security" in the subject. We reply within two business days and will not take action against good-faith research.