Frequently Asked Questions
Clear answers about how we scan your site, protect your privacy, and help you fix issues quickly.
Threat Landscape & Automated Lawsuits
Why are automated lawsuits and settlement demands surging?
Plaintiff law firms now deploy automated web crawlers that scan thousands of commercial websites every hour. These bots detect whether marketing tracking pixels (like Meta Pixel, Google Analytics, or TikTok tags) load before a visitor gives explicit cookie consent. Under the California Invasion of Privacy Act (CIPA Section 631) and similar state statutes, this pre-consent transmission is treated as unauthorized wiretapping, exposing businesses to statutory penalties of $2,500 to $5,000 per visitor. The law firms then generate automated settlement demand letters demanding $15,000 to $50,000 to avoid court.
Why would hackers or bots target my small business website?
Over 90% of cyberattacks on commercial websites are not hand-crafted or targeted by company name. Instead, automated botnets continuously sweep public IP blocks and domains looking for unpatched server software, open directories, and missing browser defense headers. If your perimeter is unhardened, automated scripts exploit it indiscriminately. Small and mid-sized businesses are frequent targets precisely because they rarely maintain dedicated security teams.
My website was built by a professional web design agency. Aren't they taking care of this?
Almost never. Web design agencies specialize in design, user experience, and SEO, while digital marketing agencies install tracking pixels to optimize advertising spend. Over 95% of agencies do not test for CIPA wiretapping compliance, TCPA lead consent, or server security headers. LeakReport acts as an independent safety net to catch what your web agency unintentionally missed before an automated crawler detects it.
Scanning Methodology & Safety
What does LeakReport actually check during a scan?
LeakReport checks publicly accessible exterior facets of your website, including HTTP/HTTPS security headers, SSL certificate settings, contact forms, cookies, and tracking scripts to identify both technical vulnerabilities and statutory privacy liabilities.
Is this scan completely safe for my website?
Yes, 100%. Our check is completely non-invasive and acts just like an ordinary web browser visiting your website. We never try to break passwords, enter private administrative areas, or slow down your server.
Delivery & Confidentiality
Why are reports only sent to the site owner or work email?
To protect your confidentiality and ensure sensitive website findings are never exposed publicly, reports are delivered exclusively to authorized email addresses matching the audited domain or the verified contact address you provide.
How long are scan results kept?
Your scan results are kept securely for 14 days so you or your web developer have ample time to review them. After 14 days, unclaimed scan records are permanently purged.
Report Packages & Fix Guides
What is included in the full report packages?
Full report packages include unblurred vulnerability dossiers, step-by-step fix guides for your web developer, ready-to-paste AI fix prompts, and a 60-day re-scan to confirm everything is fixed. Pricing is transparent and one-time: Tier 1 ($19.99), Tier 2 ($29.99), and Tier 3 ($49.99) with no ongoing subscriptions.
How do the Turnkey AI Fix Prompts work?
The Turnkey AI Fix Pack (Tier 3) provides pre-engineered instructions tailored to your specific findings. You or your developer can paste these prompts directly into ChatGPT, Claude, or Cursor to immediately generate the exact server headers, cookie consent rules, and form disclosures required, eliminating the need to hire an expensive consultant.