How the checks work
What gets asked, how often, from where, and what it can't see. Written from the code on 1 November 2026.
Each check
The quick check is the one on the free tools pages. It runs once, when you ask. Monitoring is the same kind of look, on a schedule, for sites on an account.
| Check | Quick check | Monitoring | What it looks at |
|---|---|---|---|
| Does the site load | One request for the homepage | Every 5 minutes | Anything from 200 to 399 counts as up. Slower than 5 seconds gets flagged. You hear when the answer changes, not every 5 minutes. |
| Security certificate | One TLS connection on port 443. Flags 21 days or fewer | Every 5 minutes. Warns at 30, 15, 7, 3 and 1 days | Expiry, and whether a browser would refuse it. Behind a CDN, you're seeing the CDN's certificate. |
| Security headers | Read from that one homepage response | With the same check | HSTS, X-Content-Type-Options, framing protection and Content-Security-Policy, and whether the response announces a version number. Homepage only. |
| Page source | Read from that one homepage response | Every hour, only while the site is up | Injected scripts, hidden spam links and defacement wording in the HTML. Monitoring also compares a fingerprint of the page, so a change stands out. |
| Blocklists and reputation | Not part of the quick check | Twice a day | Asks Spamhaus, SpamCop and Barracuda about the server's IP address. Asks VirusTotal and Google Safe Browsing about the site where those lookups are available. |
| Domain expiry | Public RDAP record. Flags 45 days or fewer | Once a day. Warns at 60, 30, 15, 7, 3 and 1 days | Some country domains publish no date. Then we say we don't know. |
| DNS and email records | Not part of the quick check | Once a day | SPF, DMARC and DKIM, and changes to name servers and mail servers. DKIM can only be found by trying common selector names, so a miss isn't proof it's absent. |
| New certificates for your domain | Not part of the quick check | Once a day | Reads public certificate transparency logs. |
Where the checks come from
One server, in one location. A very short outage can slip between two checks, and a network problem near our server can look like a problem with your site. It's not a worldwide test, and I won't describe it as one.
How to read a result
- Critical, High, Medium, Low say how soon something needs attention. Each finding comes with a written fix.
- Fine means that one check came back clean, today, from here. It doesn't mean the site is safe.
- Unknown means we couldn't tell. It's never counted as fine. If a blocklist doesn't answer, or a registry publishes no date, that's what you'll see.
- Bot protection: if something like Cloudflare answers instead of your site, we report what we couldn't check. We don't call the site down.
What these checks can't see
- Anything inside your server, your files, your database or your WordPress admin.
- Any page other than the homepage.
- Whether a site is clean. Looking at one page of HTML from outside can't answer that, so a report never says it.
The checks don't scan ports or try to log in. Page source markers can also be wrong in either direction, so treat a finding as a reason to look.
Servers are different
Looking inside a server needs an agent you install yourself. What it reports, and what it doesn't, including how ports and traffic really work.
Things that depend on settings
VirusTotal and Google Safe Browsing lookups need keys on our side. If they aren't available for a site, that part isn't checked. Alerts go by email, and by Telegram or WhatsApp if you add them.