Prove it's yours. Patch digs deeper.
A free scan only does what a normal visitor's browser does. Once you verify that you own a site, Patch also checks the things that need permission to look at: your database rules and files that shouldn't be public.
What verifying unlocks
- Supabase tables readable with the public key
- Firebase data readable without signing in
- Configuration files can be downloaded
Patch never stores the data he reads, never writes to your database and never submits forms. More on that on the crawler page.
Three ways to verify
Start from your report or your Patrol dashboard: choose "Verify ownership" and Patch gives you a one-off code. Then use whichever of these is easiest. You only need one.
- 01 · Meta tag
Add a tag to your homepage
Paste the tag into the <head> of your homepage and publish. In Lovable, Bolt or Cursor you can ask the AI to add it to index.html, or the root layout, exactly as given.
<meta name="shippatrol-verification" content="sp-verify-…"> - 02 · DNS record
Add a TXT record to your domain
In your domain's DNS settings, add a TXT record on the domain itself. DNS changes can take a while to show up, so if the check fails, give it a few minutes.
TXT shippatrol-verification=sp-verify-… - 03 · File
Upload a small file
Create a plain text file at this address on your site, containing only the code. Most static hosts serve anything you put in the public folder.
/.well-known/shippatrol.txt
Then press "Check now". Once verified, the next scan of that site runs the deeper checks. Verification belongs to your Patrol account if you're signed in, or to the scan if you're not.
Questions
- Why does ShipPatrol need me to verify my site?
- Some checks go further than a normal visitor would, such as asking your database for a row using the public key your site ships, or seeing whether files like /.env are reachable. Patch only does that for sites whose owner has said yes, by proving they control the site.
- Does verifying give ShipPatrol access to my site?
- No. Verification only proves you control the site. Patch gets no logins, no keys and no write access. The deeper checks use what any visitor could already reach.
- Does ShipPatrol store data from my database?
- No. Patch records whether a table answered, not what was in it. Rows are discarded as soon as the check finishes.
- Can I remove the tag or record afterwards?
- Yes. It does nothing else. If you remove it, later scans may ask you to verify again before running the deeper checks.
Start with a free scan.
Verification lives on your report. Scan your site first, then verify from there.