Help Center
Disclosed software versions, known CVEs, end-of-life and actively exploited flags
When the authority that signed your certificate is compromised or distrusted
llms.txt, agents.txt, AI crawler rules, MCP and structured data, opt-in per domain
Your domains at the start and end of any period, ready to print as a PDF
Uptime and security for one domain on one page, plus its settings
The occasional what’s-new email, and how to turn it off or back on
Multi-node checks, consensus detection, and how we determine downtime
Hard errors in seconds, timeouts take longer: why, and what you can tune
Adding domains, configuring checks, and using the dashboard
HEAD vs GET requests, check frequency, and timeout settings
Slack, email, and JIRA alert channels
How incidents are created, tracked, and resolved
Automatic branded maintenance page via Cloudflare Workers
Slow response detection with configurable thresholds
Suppress alerts during planned downtime on a recurring schedule
When your WAF blocks specific monitoring locations
Whitelist our monitoring IPs in Cloudflare, AWS WAF, or your firewall
How the A–F grade is worked out, and what moves it
SSL/TLS certificates, HTTPS redirect, HSTS and mixed content
CSP, clickjacking protection, cookie security and security headers
WAF detection, server information and hosting
DNSSEC validation and nameserver configuration
DMARC, SPF and DKIM email spoofing prevention
Invite teammates, manage roles and seat limits
Add Strict-Transport-Security on nginx, Apache, Cloudflare or IIS
› lowStart report-only, then enforce
› lowPublish DMARC, then move to quarantine and reject
› highUpgrade PHP, then hide X-Powered-By
› highRenew it, then automate renewal
› lowPHP, nginx, Node and WordPress examples
› lowStop other sites from framing your pages
› mediumFind the http:// links and load them over HTTPS
› lowSign your zone, then add the DS record at your registrar
› lownosniff, Referrer-Policy and Permissions-Policy in one go
›Every matching finding in a scan result links straight to its guide.
Paid plans include multiple team seats, allowing you to invite colleagues to share access to your domains, scans, uptime monitoring, and incidents.
Go to Account Settings and open the Team Members panel. Enter your teammate's email address and click Send Invite. They'll receive an email with a link to accept the invitation. The link expires after 7 days.
If the invited person doesn't have an InternetSecure account, they'll be directed to register first, then automatically join your team.
Owners can remove a team member from the Team Members panel in Account Settings. Access is revoked immediately. Team members can also leave on their own from the same panel.
Pending invitations can be revoked from the Team Members panel before they're accepted.
InternetSecure monitors your websites from 6 independent nodes distributed across multiple geographic locations. Each node sends an HTTP request to your domain at regular intervals and records the response status and time.
We use a consensus-based approach to avoid false positives. A single node reporting a failure does not trigger an alert — multiple nodes must agree that your service is unreachable before an incident is created.
The default consensus threshold is 3 of 6 nodes. At least 3 nodes must independently confirm that your site is down before we consider it a real outage.
Detection speed depends on how your site fails. A hard crash is caught in seconds. A slow timeout takes longer to confirm, but it is still caught.
Hard error 500 / connection refused
Detection ~1s, then peer verification ~2s per node
Slow response 10s timeout
Detection ~10s, then peer verification ~10s per node
Complete timeout 30s max time
Detection ~30s, then peer verification ~30s per node
Why the range? Every check needs consensus: several nodes must independently confirm the outage before an alert fires. That removes false alarms, but it means detection time grows with how long your server takes to fail.
You can set per-domain timeouts to tune detection speed for critical services.
By default, checks use the HEAD method, which requests only response headers without downloading the page body. This is faster and uses less bandwidth.
If your server doesn't support HEAD (some return 405), switch to GET in domain settings.
Checks run at a 1-minute interval from all active nodes. Each check has a 30-second timeout.
User agent: InternetSecure Uptime Monitor/1.0
When an incident is confirmed (consensus reached), alerts are sent through your configured channels:
You receive two alerts per incident: one when downtime is detected and one when the service recovers.
An incident is created when enough nodes agree your site is unreachable. Each incident records:
Incidents are automatically resolved when consensus confirms your site is back up.
A degraded status means some nodes can reach your site but others cannot — often a regional or CDN issue.
To enable uptime monitoring:
The Uptime Dashboard shows all monitored domains with status, uptime %, response time chart, and SSL expiry. Click any domain for detailed history.
When downtime is detected, InternetSecure can automatically deploy a branded maintenance page to your domain using Cloudflare Workers. Visitors see a professional offline page instead of an error, and the page auto-reloads when your site recovers.
How it works:
Setup:
The deployment and teardown is fully automatic — no manual action required during an outage. A cloud icon (☁) appears next to domains with an active offline page.
Degraded is a distinct status from "down" — it means your site is responding but slower than your configured threshold. The site is still reachable, but performance has dropped significantly.
How it's detected:
Status transitions:
You can configure the threshold (100ms – 30,000ms) per domain and optionally enable separate degraded alerts.
Maintenance windows let you suppress alerts during planned downtime so you don't get paged for expected outages like deployments or server restarts.
How it works:
Configuration (per domain):
Configure maintenance windows in your domain's uptime settings.
A node is flagged as blocked when it has an 80%+ failure rate over the last 24 hours while other nodes successfully reach your site. This usually means your server's firewall or WAF is rejecting requests from that node's IP address.
How to identify blocked nodes:
How to fix it:
Whitelist our monitoring IPs in your firewall or WAF. See the IP Whitelist & Firewall Rules article for step-by-step guides for Cloudflare and AWS WAF.
Blocked nodes are excluded from consensus calculations to avoid false positives — your alerting accuracy is not affected, but monitoring coverage is reduced.
If your firewall or WAF blocks our checks, you can allowlist the monitoring nodes. The IP list and copy-ready rules for Cloudflare and AWS WAF are in this article once you are logged in.
Checks whether your website properly encrypts all traffic using SSL/TLS.
Learn more: What is SSL?
Fix guides: HSTS not enabled · SSL certificate invalid or expiring · Mixed content
Evaluates security headers and cookie configurations that defend against common web attacks.
Learn more: OWASP Secure Headers Project
Fix guides: Content-Security-Policy missing · Cookies missing Secure or HttpOnly · X-Frame-Options missing · Security headers missing
Examines your server-side security posture.
Learn more: What is a WAF?
Checks your domain's DNS security and nameserver configuration.
Learn more: What is DNSSEC?
Fix guide: DNSSEC not enabled
Checks DNS records that prevent email spoofing and phishing.
Learn more: DMARC/DKIM/SPF Overview
Fix guides: DMARC missing or set to p=none
Every scan reads the software versions your site gives away (server header, X-Powered-By, CMS, plugins, JavaScript libraries) and checks them against the NVD vulnerability database, refreshed every 2 hours, and against end-of-life dates.
Findings appear in the Exposure group of the scan and in Needs attention on the domain page, most urgent first:
A clean result means your site is not advertising a vulnerable version. It cannot see versions you hide, so also check from the inside (php -v, your CMS dashboard). Exposure findings are listed separately and do not change your grade.
Fix guide: PHP version disclosed or end of life. Background: PHP2Shell and WP2Shell.
A certificate is only as trusted as the authority (CA) that signed it. When a CA is compromised or distrusted by browsers, every certificate it issued stops working, even ones that are not expired.
Our scanner and cert tools mark affected chains with a violet CA alert badge and say what happens and when. The current one: browsers distrust certificates chaining to eMudhra / emSign roots, and Chrome removes the root on October 27, 2026.
What to do: get a new certificate from a different CA (Let’s Encrypt is free), install it with the full chain, and rescan. The badge clears on the next scan.
More: The eMudhra CA compromise: is your certificate affected?
AI readiness checks how your site looks to AI assistants and crawlers: llms.txt, agents.txt, robots.txt rules for GPTBot, ClaudeBot and others, an MCP manifest, and structured data (JSON-LD).
It is off by default because it adds a handful of requests to each domain every night. To turn it on: open the domain, go to the Security scan card, click Scan settings and tick AI readiness. Changes then show up in the timeline and your digest.
Try it on any site without an account: AI Readiness checker.
Reports shows how your domains stood over a period you pick (30 days, 90 days, 6 months, a year, or custom): the grade at the start and the end, uptime and incidents, what changed and when, and what is still open.
Pick one domain or all of them. With several domains you get a summary, a table you can click through, and a section per domain. Download PDF prints exactly what you see, ready to send to your team or a client. CSV exports the raw scans.
On Pro and Enterprise the report also shows compliance frameworks (SOC 2, ISO 27001, PCI DSS, NIST, HITRUST) and a By framework view.
Click any domain under Domains to open its page. Everything about that domain is there: what needs attention, a 90-day timeline of incidents and security changes, the latest scan, response times and settings.
The left column has two cards. Uptime shows status and figures, with Edit, Pause alerts and Disable. Security scan shows the grade, SSL expiry, schedule and AI readiness, with Scan settings (schedule, AI readiness) and Scan now.
Security scanning works even when uptime monitoring is off for that domain.
A few times a year we email a short product update about new features. A copy is saved in your account under Support, in From InternetSecure.
To stop them, use the Unsubscribe from product updates link at the bottom of the email, or your mail app’s own Unsubscribe button. To turn them back on, use the Product updates switch on your profile.
This only affects product updates. Uptime alerts, security digests and security notices about your own domains are separate and keep coming.
Your grade is worked out from the checks in each scan, scored out of 100: A 85+, B 70+, C 55+, D 40+, F below 40.
The quickest wins are usually HSTS and a Content-Security-Policy. Each failing check in a scan has a How to fix link. Vulnerability (Exposure) findings are shown separately and do not change the grade.