# OrionCmd

> OrionCmd is a website security and uptime monitoring service. It watches websites for downtime, SSL/TLS certificate problems, DNS changes, email authentication issues, breach exposure, reachability, and external security findings, then turns the results into plain-language alerts and client-ready reports.

OrionCmd is passive-first: it observes publicly available signals and uses common or expected TCP-port probes for firewall reachability; a silent host may be offline or stealth-filtered. A firewall endpoint can also send an optional call-home heartbeat from a sender the owner configures; with neither signal the state is unknown, and neither signal shows the appliance's internal health. The Non-Intrusive Scan comes with paid plans and runs only on sites the owner switches it on for. The Passive Web Scan also requires a signed scope authorization confirming the site is the owner's, and OrionCmd enables it before it can run.

## Main pages

- [Home](https://orioncmd.com/): product overview and capabilities
- [How it works](https://orioncmd.com/how-it-works): How OrionCmd works — outside-in website monitoring
- [What we check](https://orioncmd.com/what-we-check): What OrionCmd checks — uptime, TLS, DNS, exposure
- [Pricing](https://orioncmd.com/pricing): plan options — Free, Standard ($29/client/mo), Pro ($79/client/mo)
- [Privacy](https://orioncmd.com/privacy): data collection, use, processors, and deletion
- [Terms](https://orioncmd.com/terms): service terms, authorized use, billing, and limitations

## Pricing

OrionCmd offers three tiers:

- **Free** ($0, forever) — 1 website per client, 1 firewall endpoint. Covers HTTP uptime and keyword checks, SSL/TLS expiry and grading, domain expiry and DNS integrity, email alerts, and a public status page for your site (when you publish one).
- **Standard** ($29 per client per month) — up to 5 websites per client (extra sites $5/mo each), 3 firewall endpoints (extra endpoints $5/mo each). Adds email setup and blocklist checks (inbox delivery is not tested), threat reputation, homepage change watch, internet-exposure and open-port watch, stealer-log and credential exposure, passive subdomain discovery (OSINT), lookalike-domain watch, origin IP exposure checks, technology detection with advisory matching for software that can be identified precisely, Non-Intrusive Scan (switched on per site by the owner), performance audits, Slack/Discord/webhook alerts, and automated client reports.
- **Pro** ($79 per client per month) — up to 15 websites per client (extra sites $5/mo each), 10 firewall endpoints (extra endpoints $5/mo each). Adds full email authentication (DKIM, DMARC enforcement, MTA-STS, TLS-RPT, BIMI), breach and paste exposure (Have I Been Pwned), Passive Web Scan (OWASP ZAP; switched on per site by the owner, requires a signed scope authorization confirming the site is theirs, and is enabled by OrionCmd before it runs), and priority support.

## Capabilities

- Uptime and HTTP availability checks with anti-flap detection; downtime and recovery are timed from the scheduled checks, not from the moment an outage began
- SSL/TLS expiry tracking, advance warnings, and configuration grading; renewal is not guaranteed
- Domain expiry (RDAP/WHOIS) and nameserver integrity monitoring
- Email setup checks (mail records, Spamhaus/Barracuda blocklists) and authentication (SPF, DKIM, DMARC, MTA-STS, TLS-RPT, BIMI); inbox delivery is not tested
- Passive web security checks: CSP, HSTS, X-Frame-Options, cookie flags, mixed content
- Threat reputation through Google Web Risk, falling back to Safe Browsing when that is unavailable; if neither answers, the result is unknown rather than clean
- Homepage hash comparison reports content changes; it does not confirm defacement
- Technology detection; versions are not always visible, and software that cannot be identified is reported as unknown rather than clean
- WordPress advisories: for sites detected as WordPress, the visible core version is checked for freshness (wordpress.org) and matched against Wordfence's published advisories. Plugins and themes referenced in the page's public assets are also detected, and matched when a version can be read reliably; when the version is ambiguous the package is reported as found but unchecked, never as clean. Plugins and themes the page does not reveal are not observable from outside. An unavailable advisory feed is reported as skipped. Runs with the paid scan layers after the owner switches scanning on for that site
- Internet-exposure watch (Standard and Pro): weekly reading of public internet-scan data (Shodan) for services and ports visible on the owner's addresses, with week-over-week change alerts. A quiet week means nothing new was observed by that source, not that nothing is exposed
- Passive subdomain discovery (Standard and Pro): weekly OSINT from certificate-transparency logs and public sources; no brute forcing. A source that fails is reported as a gap, not as a clean result
- Lookalike-domain watch (Standard and Pro): weekly sweep for newly observed domains that look similar to the owner's domain. Similarity alone does not establish abuse; a match is a name to review, not a verdict. The first sweep is a silent baseline; DNS decides what is real, and names that cannot be resolved are inconclusive rather than safe
- Candidate origin IP exposure (Standard and Pro): for CDN-fronted sites, observations of addresses that appear to answer for the site directly. A candidate does not confirm that the address is the true origin or that the CDN can be bypassed. A site that is not CDN-fronted is not applicable, never reported as safe
- Stealer-log exposure (Standard and Pro): whether the domain appears in infostealer-malware logs — credentials taken from infected computers, a distinct problem from a website breach. No result means nothing was seen in that source, not that no device was infected
- Breach and paste exposure (Pro): Have I Been Pwned lookups for addresses the owner adds, plus a domain-wide search once HIBP has confirmed domain ownership; until then the domain-wide half is unavailable, and an incomplete lookup is reported as unknown rather than clean
- Independent cloud check (optional, paired by the owner in Settings, up to 20 targets): a checker running on Cloudflare's network re-checks selected targets from outside OrionCmd's own systems, providing separate evidence to compare with OrionCmd's own checks. These observations do not change a monitor's status, uptime, grades or SLA, which come from the primary checks. It is a single outside vantage point, not a global probe network, and missing or stale independent evidence is reported as unknown rather than as an outage
- Public status pages you publish (no prebuilt demo URL), alerting (Slack, Discord, webhooks), and automated PDF/HTML client reports; alerts follow the configured channels and quiet hours and depend on the destination accepting and delivering them

## For people who manage sites for others

Owners who choose the "Websites I manage" path group sites by customer. This structure costs nothing extra and is not a separate plan tier:

- Read-only customer portals: a customer can be invited to see only their own sites and reports, with no access to other customers and no ability to change settings or start scans. Clearing the invite revokes the access
- Per-customer branding: each customer can carry their own name and logo on their reports, and a saved report keeps the branding it was generated with. There is no separate white-label add-on
- PSA and ticketing: alerts can open tickets in ConnectWise Manage, Autotask, Syncro, or Halo alongside email, Slack, Discord, and webhook alerts. The owner supplies that system's credentials, which are stored write-only; a PSA that refuses a ticket is recorded as failed rather than dropped silently