Customizable Scans in the LinkThreatScan API: Run Only the Checks You Need

Emil Gheonea

Software engineer & founder of LinkThreatScan · 10 October 2026

Until today, every call to POST /api/v1/scan ran the full LinkThreatScan scan: more than 150 checks across domain registration, HTTP headers, exposed files, TLS, open ports, IP reputation, known vulnerabilities, email authentication and fourteen threat-intelligence feeds. That is the right default when you want the complete picture of a site. It is not what every integration needs. Starting today, you can tell the API exactly which tests to run.

Pick categories, single checks, or both

A scan request now accepts two optional fields. categories names whole categories, such as websiteEncryption or email, and runs every check in them. checks names individual checks, such as hstsEnforced or envFileExposed, and the result for that category contains just those. You can combine the two in the same request. A request with neither field runs the full scan exactly as before, so existing integrations keep working without any change.

Skipped checks really are skipped

A customized scan does not run the full scan and then hide part of the answer. The work behind each check only happens when a check you asked for needs it. Ask only whether a certificate has expired and we never start the TLS cipher enumeration. Ask whether a .env file is exposed and we fetch that one path instead of probing around ninety. The same holds for WHOIS lookups, port scans, reputation services and blocklist feeds. Fewer outbound requests mean faster answers for you and a lighter touch on the site being scanned.

A score that matches the question

The risk score is computed from the checks that ran, so a scan limited to email authentication scores the domain's email posture rather than averaging in categories you did not ask about. Categories that were left out come back as null, and the response carries a selection field listing what ran, so your code can always tell a skipped category from one that could not be checked.

Who it is for

Customizable scans were built with organizations in mind. A mail-security product can ask only for SPF, DMARC, DKIM and BIMI. A link-protection gateway that decides in real time can ask only for the threat-intelligence engines and Safe Browsing. A compliance dashboard can watch certificate expiry and HSTS across hundreds of domains without paying for port scans it never displays. A customized scan counts as one scan against your quota, the same as a full one.

Every check, documented

The new checks reference at linkthreatscan.com/docs/api/checks lists every category and check you can name, with a plain description of what a true result means and, for exposed-file checks, the exact paths we probe. It has a search box to find a check by name or topic, and the same list is available as JSON from GET /api/v1/scan/checks for tooling. Names match regardless of case, and an unknown name is rejected with a 400 that lists it, so a typo can never quietly scan less than you meant.

Get started

Customizable scans are available now to every API key, personal and organization alike. Open the API keys page in your dashboard, expand How to use the API for a ready-to-copy example, and follow the link to the checks reference to choose what your integration needs.