scanDomain — Using the free scan API

The FreeScan API is a request for a domain scan to the Free Scan API endpoint. After a period of time (possibly as long as 45 seconds), you will receive the XML response with the pages found on the domain, along with a field specifying if the page is determined to have malware.

The API endpoint is:

https://scan.sitelock.com/v1/partner/

Request format

SiteLockOnlineRequest: This element is used to delineate the full API request.
- authentication: The partner’s username, password, and branding
  - username: The partner’s API username
  - password: The partner’s API password
  - partner: (Optional) The brand name to use in messaging
- scanDomain: The method name
  - domain: The domain name to scan

Example request

<SiteLockOnlineRequest>
    <authentication>
        <user>Username</user>
        <password>Password</password>
    </authentication>
    <scanDomain>
        <domain>example.com</domain>
    </scanDomain>
</SiteLockOnlineRequest>

Response format

The SiteLock response returns a full XML output which includes the pages and malware results for the domain in question.

Example success response

<SiteLockOnlineResponse>
    <scanDomain>
        <pages>
            <page url="http://www.example.com/" malware="no" />
            <page url="http://www.example.com/th1s_1s_a_4o4.html" malware="yes">
            <malware_data>
                <malware source="sitelock_sig">
                <malware_info>SiteLock-JS-SEOSPAM</malware_info>
                </malware>
            </malware_data>
            <link url="http://www.example.com/th1s_1s_a_4o4.html" malware="yes" malware_source="sitelock_sig" type="internal" source="html">
            <malware_data>
                <malware source="sitelock_sig">
                <malware_info>SiteLock-JS-SEOSPAM</malware_info>
                </malware>
            </malware_data>
            </link>
            <link url="http://www.example.com/th1s_1s_a_4o4.html?%3DSend%26_wpcf7%3D322%26_wpcf7_unit_tag%3Dwpcf7-f322-w1-o1%26_wpcf7_version%3D3.4.2%26_wpnonce%3D88a30eb1ef%26biz-name%3D1%26full-name%3D1%26interested-in%3DCommercial Cleaning%26your-email%3D1%26your-phone%3D1" malware="yes" malware_source="sitelock_sig" type="internal" source="html">
                <malware_data>
                    <malware source="sitelock_sig">
                    <malware_info>SiteLock-JS</malware_info>
                    </malware>
                </malware_data>
            </link>
            </page>
            <page url="http://www.example.com/th1s_1s_a_4o4.html?%3DSend%26_wpcf7%3D322%26_wpcf7_unit_tag%3Dwpcf7-f322-w1-o1%26_wpcf7_version%3D3.4.2%26_wpnonce%3D88a30eb1ef%26biz-name%3D1%26full-name%3D1%26interested-in%3DCommercial Cleaning%26your-email%3D1%26your-phone%3D1" malware="yes">
                <malware_data>
                    <malware source="sitelock_sig">
                    <malware_info>SiteLock-JS</malware_info>
                    </malware>
                </malware_data>
            </page>
        </pages>
        <notes>
            <note>
                <cat>info</cat>
                <str>www.example.com/ has the following DNS Information:</str>
                <page>www.example.com/</page>
                <severity>0</severity>
                <mod>dns_info</mod>
            </note>
            <note>
                <cat>app</cat>
                <str>Application Wordpress:
                Version 3.5.2 found on http://www.example.com/th1s_1s_a_4o4.html</str>
                <page />
                <severity>2.5</severity>
                <mod>wordpress</mod>
            </note>
            <note>
                <cat>suspicious_content</cat>
                <str>External Redirect found to
                http://www.john-doe.com/ on sample pages http://www.example.com/)</str>
                <page>http://www.example.com/</page>
                <severity>2.5</severity>
                <mod>redirect_check</mod>
            </note>
        </notes>
        <virusscan>
            <match page="http://www.example.com/th1s_1s_a_4o4.html" info="SiteLock-JS-SEOSPAM-g.UNOFFICIAL" />
            <match
            page="http://www.example.com/th1s_1s_a_4o4.html?%3DSend%26_wpcf7%3D322%26_wpcf7_unit_tag%3Dwpcf7-f322-w1-o1%26_wpcf7_version%3D3.4.2%26_wpnonce%3D88a30eb1ef%26biz-name%3D1%26full-name%3D1%26interested-in%3DCommercial Cleaning%26your-email%3D1%26your-phone%3D1" info="SiteLock-JS-SEOSPAM.UNOFFICIAL" />
        </virusscan>
        <summary>
            <scan_duration>3.88</scan_duration>
            <malware_links>2</malware_links>
            <links>2</links>
            <pages>3</pages>
        </summary>
        <sslinfo has_ssl="0" />
    </scanDomain>
</SiteLockOnlineResponse>

Example error response

<SiteLockOnlineResponse>
    <scanDomain>
        <error>domain is a required field</error>
    </scanDomain>
</SiteLockOnlineResponse>