Priced per workspace, not per scare.
Watch one site at no cost, with no plan time limit. For broader outside-in monitoring, one flat monthly price covers up to 5 sites — 15 on Pro, plus $5/mo per extra site or firewall endpoint. Manage sites for other people? Each of them is its own workspace, priced the same way. Everything runs from outside your network with nothing to install. Routine checks are passive-first; reachability probes and optional authorized scans are clearly identified.
Free
Core uptime watch for one website. No card, no time limit.
Start Free- 1 website
- 1 firewall endpoint
- HTTP uptime & keyword checks
- SSL / TLS expiry & grading
- Domain expiry & DNS integrity
- Email alerts on incidents
- Public status page for your site (when you publish one)
Standard
Broader outside-in monitoring for up to 5 sites in one workspace.
Start with Standard- Up to 5 websites in the workspace
- 3 firewall endpoints
- Extra sites: +$5/mo each
- Extra firewall endpoints: +$5/mo each
- Everything in Free, plus:
- Threat intelligence from ThreatCluster: indicator matches and reported ransomware claims; technology briefings and CVE context when you switch on scanning per site
- Email setup & blocklist checks (inbox delivery isn't tested)
- Threat reputation & homepage change watch
- Internet-exposure & open-port watch — a weekly read of public scan data (Shodan) showing what's visible from outside; a quiet week means nothing new was seen there
- Stealer-log & credential exposure — logins taken off infected computers, which is a different problem from a website being breached
- Subdomain discovery (passive OSINT) — weekly, from certificate logs and public sources, so forgotten staging and admin hosts surface; nothing is brute-forced
- Lookalike-domain watch — weekly sweep for newly observed domains that look similar to yours; similarity alone doesn't establish abuse, the first sweep is a silent baseline, and a name DNS can't resolve is inconclusive rather than safe
- Origin IP exposure checks — for CDN-fronted sites, possible origin addresses that answer directly; a candidate doesn't confirm the origin or a CDN bypass, and a site with no CDN in front is simply not applicable, never reported as safe
- WordPress advisories — freshness plus Wordfence advisories for the core version we can see, and for plugins and themes the page refers to publicly when their version is readable; the rest are listed as found but unchecked
- Technology detection; versions aren't always visible, and unidentified software stays unknown
- Non-Intrusive Scan (you switch it on per site)
- Performance audits (Lighthouse)
- Slack / Discord / webhook alerts
- Automated reports
Pro
Deep email authentication and breach visibility on top of Standard.
Go Pro- Up to 15 websites in the workspace
- 10 firewall endpoints
- Extra sites: +$5/mo each
- Extra firewall endpoints: +$5/mo each
- Everything in Standard, plus:
- Threat intelligence from ThreatCluster: indicator matches and reported ransomware claims; technology briefings and CVE context when you switch on scanning per site
- Full email authentication (DKIM, DMARC enforcement, MTA-STS, TLS-RPT, BIMI)
- Breach & paste exposure (Have I Been Pwned) — per address you add, plus a domain-wide search once HIBP has confirmed you own the domain
- Passive Web Scan (you switch it on per site and sign a scope authorization confirming the site is yours; we enable it before it runs)
- Priority support
Common questions
What counts as a workspace?
A workspace is one business you watch. If you are looking after your own site, that is your workspace and you pay for one. If you look after sites for other people, each of them is a separate workspace, priced the same way. Paid plans include up to 5 websites per workspace on Standard and 15 on Pro, with extra sites at $5/mo each — you pay per business, not per URL. Firewall endpoints are counted separately: 1, 3, or 10 per workspace by plan, with extra endpoints at $5/mo each on paid plans.
Is any of this intrusive to the sites being watched?
Routine monitoring is designed to be lightweight and observes from outside your network. Firewall reachability probes common or expected TCP ports; a silent host may be offline or stealth-filtered, and the optional call-home heartbeat only reports in if you configure a sender. With neither, the state is unknown rather than down, and neither shows the appliance’s internal health. The Non-Intrusive Scan comes with Standard and Pro and only runs on sites you switch it on for. The Passive Web Scan (OWASP ZAP) is on Pro: you switch it on per site and sign a scope authorization confirming the site is yours, and we enable it before it runs. Neither sends exploit payloads.
What happens if I outgrow the free tier?
Free covers one website in a workspace with uptime, SSL and domain watch. Upgrade a workspace to Standard whenever you like — its history and alerts carry over, and the security layers start on the next scheduled check.
I look after sites for other people — do portals, branding and tickets cost extra?
No. Grouping sites by customer, inviting a customer to a read-only portal of just their own sites, putting their name and logo on their reports, and opening tickets in ConnectWise Manage, Autotask, Syncro or Halo are part of the product at every plan level — there is no white-label add-on and no PSA tier. You supply the credentials for your own PSA. What you do pay for is monitoring depth: each customer workspace sits on its own Free, Standard or Pro plan.
Can I compare the checks against something outside OrionCmd?
Yes, optionally. You can pair an independent checker that runs on Cloudflare's network from Settings and point it at up to 20 of your targets. It re-checks them from outside our own systems and gives you separate evidence to compare with OrionCmd's own checks. It doesn't change a monitor's status, uptime, grades or SLA — those come from the primary checks. It is one outside vantage point rather than a worldwide probe network, and when its evidence is missing or stale we say so instead of treating it as an outage.
Do I need a credit card to start?
No. Sign up, add a website, and the free watch starts immediately.
Start watching in minutes.
One website free, no card. Upgrade a workspace only when you need the full watch.