Know your website.Know what to do next.

Monitoring & uptime

• HTTP availability

  Timed status and keyword checks with anti-flap detection.

• DNS resolution

  Continuous mapping of A, AAAA, CNAME and MX records.

• Firewall endpoint watch

  External probes of expected or common TCP ports, plus an optional heartbeat if you configure a sender. Neither shows the appliance's internal health, and with no usable evidence the state is unknown rather than down.

• SSL / TLS expiry

  Tracks certificate expiry and warns before the observed expiry; cannot guarantee renewal.

• TLS grading

  Protocols, ciphers and chain analysis, graded A+ to F.

• Domain expiry & integrity

  RDAP/WHOIS tracking plus nameserver and delegation change detection.

• Email setup & blocklist checks

  Checks that your domain's mail records are in place and that it isn't on the Spamhaus or Barracuda blocklists. It does not test whether your email reaches the inbox.

• Email authentication

  SPF and DMARC on Standard; DKIM, MTA-STS, TLS-RPT and BIMI on Pro.

• Search indexability

  robots.txt and noindex header monitoring.

• Homepage change detection

  Compares homepage hashes and reports content changed; it does not confirm defacement.

• Threat reputation

  Looks your site up with Google Web Risk, falling back to Safe Browsing when that isn't available. If neither answers, the result is shown as unknown, not clean.

• Passive web security

  CSP, HSTS, XFO, cookie flags and mixed-content validation.

• Independent cloud check

  Optional separate evidence to compare with our own checks: a checker running on Cloudflare's network re-checks the targets you choose (up to 20) and reports back. It doesn't change your monitor status, uptime, grades or SLA — those come from the primary checks. You pair it in Settings, and it's one outside vantage point, not a worldwide probe network; when its evidence is missing or stale we say so.

Exposure & security scanning

• Technology detection

  Identifies the software your site runs on from what it shows publicly. Versions aren't always visible, and anything we can't identify stays unknown rather than counted as safe.

• Known-vulnerability matching

  Software we could identify precisely is looked up in public vulnerability databases (OSV.dev). Anything we couldn't pin down isn't matched, and isn't treated as clear.

• Performance audit

  Lighthouse profiling via PageSpeed Insights.

• Non-Intrusive Scan

  Comes with paid plans and stays off until you switch it on per site. Looks for exposed admin panels and misconfigurations; it never sends exploit payloads.

• Passive Web Scan

  A deeper read-only OWASP ZAP review, on Pro. You switch it on per site and sign a scope authorization confirming the site is yours; we enable it before the first scan.

• WordPress advisories

  If a site runs WordPress, the core version we can see from outside is checked for freshness and matched against Wordfence's published advisories. Plugins and themes the page refers to publicly are picked up too, and matched when their version is clearly readable; when it isn't, they're listed as found but unchecked rather than clear. Anything the page doesn't reveal stays invisible to us, and a feed we can't reach is reported as skipped. Runs with the paid scan layers once you switch scanning on for that site.

• Internet-exposure watch

  A weekly look at what public internet-scan data (Shodan) already says about your addresses: services and ports visible from outside, and what changed since last week. It's someone else's observation, so a quiet week can mean nothing new was seen rather than nothing is exposed. Standard and Pro.

• Subdomain discovery

  Passive OSINT — certificate-transparency logs and public sources are read weekly for names under your domain, so forgotten staging, admin and legacy hosts surface. Nothing is brute-forced, and a source that fails is shown as a gap, never as a clean result. Standard and Pro.

• Lookalike-domain watch

  A weekly sweep for newly observed domains that look similar to yours. Looking similar doesn't establish abuse, so a match is a name to review rather than a verdict. The first sweep is a silent baseline; alerts start with names that appear after it. DNS decides what's real, so a name we can't resolve is inconclusive, not safe. Standard and Pro.

• Candidate origin IPs

  For sites behind a CDN, we look for addresses that appear to answer for the site directly — possible origins to review. A candidate doesn't confirm it is the real origin or that the CDN can be bypassed. If a site isn't behind a CDN this simply doesn't apply, and it's never reported as safe. Standard and Pro.

• Stealer-log exposure

  Checks whether your domain turns up in infostealer-malware logs — logins taken off infected computers, which is a different problem from a website being breached. It's a weekly check against a public source; nothing found means nothing was seen there, not that no device was infected. Standard and Pro.

• Breach & paste exposure

  Have I Been Pwned lookups for the addresses you add, plus a domain-wide search once HIBP has confirmed you own the domain. Until that confirmation the domain-wide half stays unavailable, and a lookup we can't complete is reported as unknown rather than clean. Pro.

Platform & reporting

• Automated reports

  PDF and HTML exports with plain-English incident explanations.

• Public status pages

  Subscriber notifications and downtime reporting for a status page you publish.

• Operator alerting

  Slack, Discord and webhook dispatch with configurable quiet hours.

• Scan safeguards

  Optional scans stay off until you switch them on for a specific site, and each needs the right plan. The Passive Web Scan also needs a signed scope authorization confirming the site is yours, and we enable it before it can run.

• Customer portals

  If you look after sites for other people, you can invite a customer to a read-only view of their own sites and reports — nothing from your other customers, and no ability to change settings or start scans. Clearing the invite takes the access away again. No extra plan needed.

• Your customer's branding

  Each customer can carry their own name and logo on their reports, so what you hand over looks like your work rather than ours. A saved report keeps the branding it was generated with. There's no separate white-label add-on to buy.

• PSA & ticketing

  Alerts can open tickets in ConnectWise Manage, Autotask, Syncro or Halo alongside your other alert channels. You supply that system's credentials, which are stored write-only; there's no extra tier for it, and a PSA that refuses a ticket is recorded as failed rather than quietly dropped.