Website security monitoring
Coming soonA security scan tells you about one moment. Monitoring is what tells you about the next one — and the risk that matters most is the one that appears while nothing on your site changed at all.
What continuous monitoring is
Continuous monitoring means re-running the same checks on a schedule and telling you only when something moves. Instead of remembering to scan, you hear from us when a result gets worse.
It exists because website risk is recurring, not one-off: new vulnerabilities are published against software you already run, certificates expire on a fixed date, and blacklistings arrive without notice.
Why a one-time scan expires
Nothing has to change on your website for it to become vulnerable. A plugin version that was clean this morning gets a CVE published against it this afternoon, and from that moment it is on the list every automated scanner works through. Your site did not change; the world's knowledge about it did.
The other two are simply scheduled. A certificate has an expiry date, and the day it passes, visitors get a full-page browser warning instead of your site. A blacklisting follows a compromise, and every hour before you notice it is an hour of blocked traffic and undelivered mail.
All three share a shape: cheap to catch early, expensive to find late. That is the whole argument for monitoring, and it is why security is a subscription rather than a purchase.
What gets watched
Every signal below is a check that already runs in the scan. Monitoring re-runs them and tells you when a verdict changes.
- New CVEs on your stackA vulnerability published against the CMS core, plugin, or front-end library version your site is currently serving, counted per version rather than as a package lifetime total.
- Certificate expiryA warning while renewing is still a task rather than an outage, starting 30 days out, plus an alert if the certificate stops verifying for any other reason.
- Blacklisting and Safe BrowsingThe moment your domain appears on a DNS blocklist or gets flagged by Google Safe Browsing — usually the first outside confirmation that something is wrong.
- Security headers and HTTPSA redeploy that quietly drops your headers, an HTTPS redirect that stops redirecting, or mixed content reappearing after a content edit.
How it works
- 1We re-run the passive scan on your domain on a schedule.
- 2Each result is compared against the last one, so you hear about changes rather than about status.
- 3When a verdict gets worse, you get an email naming what changed and what to do about it.
- 4Nothing changes, nothing arrives. No weekly digest of good news.
Available right now: a free watch
The paid Monitor plan is not live yet, but you do not have to wait to be told when something slips. Every public report carries a free watch: leave an email on it and we will alert you if that site's security gets worse — a new vulnerability, an expiring certificate, a blacklisting.
It needs no account, covers one domain, and you can unsubscribe from any alert. Scan a site, then start the watch from its report page.
Scan a site and start a free watchMonitor: be first when it lands
Coming soonDaily re-scans across all five axes, alerts the moment a new CVE hits your stack, multiple domains, history, and API access. Leave an email and we will tell you the day it launches — no charge until then, and nothing else sent in the meantime.
$19/mo planned at launch. Pricing may change before then.
FAQ
- How is this different from uptime monitoring?
- Uptime monitoring tells you the site is reachable. This tells you it is reachable and exposed — a site with a fresh critical CVE, an expiring certificate, or a blacklisting responds with a perfectly healthy 200 the whole time.
- What can I use today, before Monitor launches?
- The free per-report watch, which is live now. It covers one domain, needs no account, and emails you when that site's security slips. The paid plan adds daily re-scans across every axis, multiple domains, history, and API access.
- How often will I actually hear from you?
- Only when something changes for the worse. There is no scheduled digest and no marketing on the alert channel, because an alert that arrives weekly stops being read by the time it matters.
- Does monitoring require verifying my domain?
- Not for the passive checks, which read only what your site shows every visitor. Verification is required for the active layer — exposed files, open ports, admin surfaces — because probing a domain without permission is the line we do not cross.