Adding and verifying domains

Monitored vs. prospect scans

A prospect scan is a one-off. It is unlimited on every plan, including Free, and it does not

count toward your domain limit.

A monitored domain is rescanned automatically on a schedule and produces alerts when

something changes. Monitored domains count toward your plan limit.

Scan frequency

• Weekly — the default, and right for most domains.
• Daily — available on Practice and Firm. Worth it for domains where DNS is edited by someone outside your control, such as a client whose marketing agency has registrar access.
• Monthly — for domains you want in the report but do not need alerts on.

Verification, and why it exists

You can monitor any domain without verifying it. Verification unlocks the **exposed configuration

checks** — probes for readable .env files, exposed .git directories, database dumps and

debug logs.

We gate those behind proof of control on purpose. Requesting somebody else's .env file is a

different act from reading their homepage, and we are not willing to do it on an unverified

say-so. This is a deliberate product decision, not a technical limitation.

To verify, publish the TXT record we show you at the root of the domain and press Check. The

record can be removed once verification succeeds.

Removing a domain

Deleting a domain deletes its scan history immediately and frees the slot the same moment.