Why only some checks run
Sloptic has 102 tests. On a URL nobody has proven they own, it runs the 44 checks that only read what a visitor can see. Why?
The two kinds of tests
These read what your app already shows to everyone. Running them on a stranger's site is no different from visiting it, so they run on any URL.
These poke the app in a myriad of ways, including submitting forms, sending large requests, uploading files and attempting injection attacks. Doing this would be unauthorized testing on a site you do not own, which is why we have to verify you control the site before running them.
Verify a site
Sign in to verify a site you own. Permission attaches to an account, so there is nothing to verify against until there is one.
How to verify
Three things are needed:
An account
Permission attaches to a person.
A file you serve
Publish the token we give you at /.well-known/sloptic-verification.txt. Only whoever controls the website can put it there. Note that it MUST be at this exact path!
A DNS record
The same token in a TXT record at _sloptic.your-domain.com. If you do not have a custom domain, you can attach one or enter a verified event.
What verification implies
Verifying does not make a site globally available for active grading, only that YOU can grade it. The rest still only get passive checks.
Permission applies to the exact site you verified.
Permission lapses after a few months, after which you need to re-verify.