There's no such thing as "read access" when it comes to web security. People think there is but consider, for example, 1. Benign GET / repeated 1000 times per

There's no such thing as "read access" when it comes to web security. People think there is but consider, for example, 1. Benign GET / repeated 1000 times per second. That's a DoS on the server 2. Shellshock. Looks like a benign GET / but nasty payload in User-Agent header 3. Simple GET but with SQLi in the URI All these are real examples. All seen through Tor (and, of course, without Tor).