Skip to content

Help

The four levels

Fix nowFix now
Someone could take data or control of the site today.
Fix soonFix soon
A real weakness that an attacker would look for.
Should fixShould fix
Makes an attack easier or more damaging.
Worth tidyingWorth tidying
Good practice that is missing.

Getting started

How do I add my website?
Sign in, open Websites, and enter its address. One subscription covers 3 addresses. www.example.com and example.com are separate addresses: add the one your visitors end up on.
How do I prove it is mine?
The website's page shows a code and three ways to place it: a small file, a tag in the home page, or a DNS record. Do one, then press the button. If someone else looks after your site, enter their email and the steps are sent to them.
It says the proof was not found.
Check the code was copied exactly, with nothing added, and that the change is published. A DNS record can take a while to spread; look again later. If the site sends visitors from one address to another, add the address they end up on.
When does the first check run?
By itself, as soon as the proof is found. It usually takes under a minute, and the page updates when it is done.

Reading the results

What do I do with the list?
Start at the top: it is ordered by how serious each problem is. Open one to see what it is, why it matters and how to fix it. Each has words you can forward to your web person as they are.
How do I send it to my web person?
On the website's page, make a share link. Anyone with the link can read that website's findings, with the technical detail, without an account. Links expire, and you can switch one off at any time.
What does “Nothing found” mean?
That this check found nothing wrong. The page lists which checks ran, and Sentinel looks again next week.
A check says “Not checked”.
Sentinel could not run it, and says why: for example, there is no certificate to read on a site that does not offer HTTPS. A check that did not run is never counted as a pass.
I am not going to fix one of these.
Open it and accept the risk, with your reason. It leaves your list and appears on reports as an accepted risk. If the problem later disappears it is marked fixed.

Over time

How often is my site checked?
Every week. You can start a check yourself up to 6 times a day for each website, for example after a fix.
How do I know something was fixed?
Start a check. A problem that is no longer found moves to Fixed. If it comes back later, the same entry reopens with its history.
When will I get an email?
When a check finds something new marked Fix now or Fix soon, when your certificate is within 14 days of expiring, and if the proof that the site is yours goes missing. One email for each, not one every week.
Checks have stopped.
Sentinel looks for your proof before every check and every 24 hours. If the file, tag or DNS record has gone, often after a rebuild or a move, checks stop until it is put back.

Safety

Can a check break my site?
It is built so it cannot. It only reads, as a visitor's browser does. It never submits a form, tries a password or sends data designed to trigger a fault, and it limits how fast and how much it asks for.
Can someone else check my site?
Not without placing their own code on it, which needs control of the site or its domain. Your code proves nothing for anyone else.
What do you keep?
The findings, with the part of each response that shows the problem. Passwords and keys found on a site are masked before anything is stored. A record of every request a check made is kept for investigating abuse.

More detail: how ownership is proven, about the scanner.