Why only 37 checks
Sloptic has 91 checks. On a URL nobody has proven they own, it runs 37 of them. Here is why, and what changes when you prove the site is yours.
The two kinds of checks
These read what your app already shows every visitor: its settings, the page it serves, how fast it loads, whether a screen reader can use it. Running them on a stranger's site is no different from visiting it, so they run on any URL. They are also where most of the score comes from.
These go looking for holes by sending real attack traffic: injection payloads, malformed input, file uploads, repeated logins. That is genuinely useful on your own app and genuinely not okay on someone else's, which is why they stay locked until we know who is asking and that they own the target.
This is not a paywall. Pointing attack traffic at a site you do not own is unauthorized testing, whatever your intent.
What proving ownership takes
Two things, because they answer two different questions: who is asking, and do they control the site.
Permission is attached to a person, not to a URL. It means a request to run the hands-on checks is always traceable to someone who agreed to the terms.
We give you a random string. You publish it at a fixed path on the site:https://your-site.com/.well-known/sloptic-verification.txt
We fetch that path and check it matches. Putting a file at a chosen path on a site is something only whoever controls the deployment can do, which is exactly the thing being proven.
A TXT record at _sloptic.your-domain.com holding the same token. The file proves you control what the site serves, the DNS record proves you control the domain itself. They are separate things, so someone who manages to plant a file still cannot pass.
The rules it follows
Verifying does not mark a site as open season. It records that your account may run the hands-on checks on that site. Someone else pasting the same URL still gets the 37.
Permission applies to the exact site you verified, and a redirect cannot carry it somewhere else.
The token has to still be in place when a grade runs, and permission lapses after a few months. A domain that changes hands does not inherit the old owner's permission.
If your app is on a platform subdomain
On an address like your-app.vercel.app, the DNS record is not something you can add, since the domain belongs to the platform. Two ways forward: attach a custom domain, which you control fully, or enter an event, where the organizer vouches for the entries and the file token is enough on its own.
One more case worth knowing: if your app serves the same page for every path, as many single-page apps do, the token file can get swallowed by that catch-all. Then a <meta name="sloptic-site-verification"> tag in the page head does the same job.