Documentation

Enter any public URL and Watchpost looks at it from the outside, the same view an attacker has. A standard scan is passive and read-only: it loads your homepage and its JavaScript, performs a TLS handshake, runs DNS lookups and requests a short list of well-known paths such as /.env or /.git/config.

It never submits forms, never tries to log in and never sends exploit payloads. Most scans finish in under a minute. Results for the same host are reused for 24 hours, so repeated scans don't hit your server again.

See every check we run in the check catalog.

• Passive: anyone can run it against any public site. It only reads what is already public.
• Deep: only for signed-in owners who have verified the domain. Deep checks actively test configuration, for example whether Supabase tables or Firebase databases can be read with the public key shipped in your site.

Deep checks record counts and names only (for example "table profiles: 1,204 rows readable"), never the data itself. Deep scan reports are visible only to the site owner.

Add the site from your dashboard. You get a token; publish it using any one of these methods, then press Verify:

1. DNS TXT record on the host: watchpost-verify=<token>
2. File at https://your-domain/.well-known/watchpost-verify.txt containing the token
3. Meta tag in your homepage <head>: <meta name="watchpost-verify" content="<token>">

Ownership is re-checked before a deep scan once it is older than 30 days. If the token is gone, deep scans are locked again until you re-verify.

• Anonymous scans: 5 per minute and 50 per day per IP address.
• Results for the same host are cached for 24 hours.
• Sites you own: a passive rescan every 5 minutes and one deep scan per hour.
• Up to 20 sites per account.

Every scan starts at 100 points. Each finding subtracts points by severity: critical 40, high 15, medium 5, low 1. The score maps to a grade: A 90+, B 75+, C 60+, D 40+, F below 40. Any critical finding caps the grade at D.

A good grade means we found nothing within the scope of our checks. It is not a penetration test or a guarantee that a site is secure.

Anonymous scan reports are unlisted: anyone with the link can open them, but they are excluded from search engines. Reports for sites in your account, passive or deep, are visible only to you.

The same endpoints the website uses are open, subject to the limits above:

• POST /api/v1/scans with {"url": "https://example.com"} returns {"id": "…"}
• GET /api/v1/scans/<id> returns status, grade and findings
• GET /api/v1/checks returns the check catalog

Please identify your integration with a descriptive User-Agent.