Getting started

Guardr scans your site externally - no code changes, no agents, no server access required. This guide walks you through adding a site, reading your security score and setting up alerts so you know the moment something changes.

1 - Add your first site

From the dashboard, click Add site and enter your domain - for example example.com. You do not need to include https://. Guardr normalises the input and begins a full external scan immediately.

The first scan typically completes within 5 seconds. Once done, your site appears in the dashboard with an A–F security grade and a list of findings sorted by severity.

Every plan: all findings are visible in the dashboard with severity labels, descriptions and fix instructions.

Each plan has a site limit. You can manage or remove sites at any time from Dashboard → Sites.

Plan	Sites	Scan frequency	History
Free	1	Every 6 hours	90 days
All sites	As many as you pay for, at $3.00 per site per month	Every 6 hours	90 days

2 - Organise sites into groups

Groups keep a long site list readable. If you manage sites for several clients, a group per client lets you filter the dashboard down to one of them at a time. Groups are available on every plan, including Free.

A site belongs to at most one group. Assigning a site to a group replaces whatever group it was in before. A site that is not in any group sits under Ungrouped. Group names can be up to 100 characters.

Assign a group when you add a site

The Add site form has a Client group dropdown. Pick an existing group, leave it on Ungrouped or choose + Create new group to name a new one without leaving the form. The new group is created immediately and becomes the selection, so the site you are adding lands in it.

Move a site that is already added

Every row in the sites list has a three-dot menu. Open it and use Move to group to reassign the site. That dropdown offers the same + Create new group option, so you can create a group and move the site into it in one step. Choose Ungrouped to take a site out of its group without deleting anything.

Filter by group

A row of chips above the sites list filters it: All, one chip per group and Ungrouped. Past six groups the extra chips collapse behind a +N more toggle to keep the row from pushing the list down the page. The active filter is kept in the page URL, so a filtered view survives a reload and can be shared as a link.

Rename and delete

Each group heading in the list carries a rename control and a delete control. Renaming updates the heading, the filter chip and every site in that group at once.

Deleting a group never deletes sites. The group itself is removed and every site that was in it moves to Ungrouped, still monitored and still scanning exactly as before. Guardr asks you to confirm before deleting.

Suggested groups

Guardr also spots sites that look like they belong together. When two or more ungrouped sites share a registrable domain - app.acme.com and acme.com, for example - they are shown together in a container with a dashed border, under that shared domain.

A suggestion is only a suggestion: nothing has been created and nothing has moved. Create group from these turns it into a real group named after the shared domain and assigns every site in it. Sites that are already in a group are never included in a suggestion, so a suggestion never competes with a grouping you made yourself.

3 - Changing or cancelling your plan

On the All sites plan you choose how many sites you pay for, from Dashboard → Billing. A new count takes effect once LemonSqueezy confirms the change. Lowering the count is refused while more sites are active than the new count allows, so remove sites from the dashboard first. If sites are added before LemonSqueezy confirms a lower count, the newest sites stay active and the rest pause until you add sites again.

Cancelling keeps your paid plan's features active until the end of your current billing period. When that period ends, your account automatically reverts to the Free plan - there is no immediate loss of access the moment you cancel.

4 - Understanding your security score

Every site receives a letter grade from A (best) to F (worst), calculated from a weighted score across five scan categories. The numeric score runs 0–100.

Category	Weight	What is checked
TLS / SSL	28%	HTTPS enforcement, HTTP→HTTPS redirects, HSTS header, redirect chain depth, certificate expiry
Security headers	28%	Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy
Exposure paths	20%	Publicly accessible `.git`, `.env`, `phpinfo.php` and other sensitive paths
Cookie security	14%	`Secure` flag, `HttpOnly` flag and `SameSite` attribute on authentication and session cookies
DNS security	10%	DNSSEC validation, CAA records (checked via DNS-over-HTTPS)

In addition to the graded categories, Guardr scans your live JavaScript bundles for exposed API keys - OpenAI, Anthropic, Stripe (live keys), AWS access keys, Google AI / Gemini keys and Supabase service_role JWTs. A confirmed critical-severity secret (OpenAI, Anthropic, Stripe, AWS and Supabase service_role keys) drops the exposure score to 0. A confirmed high-severity secret (Google AI / Gemini keys) caps the exposure score at 20 instead. Either will lower your overall grade.

Every plan: you receive the full A–F grade, numeric score and complete findings list with severity labels and descriptions. Fix instructions - including effort level (quick fix, some setup, plan carefully) and platform-specific code snippets for Cloudflare, Nginx and Apache - are shown for every finding in the dashboard.

The grade thresholds and per-category scoring weights are documented in detail on the Methodology page.

Reading the findings list

Each finding shows its severity (critical, high, medium or low), the affected category, a plain-English description of the risk and an effort indicator - Quick fix, Some setup or Plan carefully - so you know what you are committing to before you start. Each actionable finding also includes platform-specific code snippets for Cloudflare, Nginx and Apache. Apply the fix for your platform and re-scan to confirm the issue is resolved.

5 - Configure alerts

Guardr sends email alerts when your site changes state. Alerts are configured per site from the Alerts section on the site detail page. Each alert type has an independent cooldown to prevent repeated notifications for the same condition.

Alert types

Alert	Plan	Trigger
Downtime	Both plans	3 out of 3 global regions confirm the site is unreachable (see Uptime monitoring)
Recovery	Both plans	Site returns to reachable after a confirmed outage
Grade drop	Both plans	Security grade drops by one or more levels (e.g. B → C)
SSL expiry	Both plans	TLS certificate expires within 30 days (first alert) or 7 days (second alert)
Weekly summary	Both plans	Scheduled weekly digest of score, top issues and SSL status

The 30-day and 7-day SSL expiry triggers are tracked and re-alerted independently, not as a single combined alert - the 30-day warning re-alerts every 14 days it remains true. The 7-day warning re-alerts every 3 days, so you can receive both as a certificate approaches expiry.

What a grade-drop alert contains

When Guardr detects a grade drop, the email includes:

The old and new grade (e.g. C → C-)
A list of newly detected issues since the previous scan
The new numeric score and detection timestamp
A View Details link to your dashboard where you can open the site and review the scan history

6 - Uptime monitoring

Guardr probes each site on a regular interval using an HTTP HEAD request with a GET fallback. The probe interval is the same on both plans.

Plan	Probe interval
Free	Every minute
All sites	Every minute

How outage confirmation works

A single failed probe does not trigger an alert. On the first failure, Guardr fans out to three independent Durable Object probes in separate global regions:

US East
Western Europe
Asia Pacific

All three regions must confirm the failure (3/3) for Guardr to record a real outage and fire an alert. If any of the three regions does not confirm the failure, the check is recorded as a transient blip and no alert fires. This prevents false alarms from regional network issues or brief WAF responses.

Once monitoring has started, a 3-region verified badge appears in the uptime dashboard to indicate that the monitoring system uses multi-region confirmation.

The same uptime data can be published to your customers on a status page, grouped under labels you choose rather than by domain. Both plans include status pages.

Response codes

Not every non-200 response means the site is down. Guardr treats the following codes as expected behaviour and records the site as UP:

403, 429, 503 - WAF blocks, rate limits and maintenance responses
520, 521, 522, 524, 527 - Cloudflare transient errors (not alerted)

The following codes are treated as real failures that contribute to outage confirmation:

523 - Origin unreachable
525, 526 - Invalid or expired SSL certificate
530 - DNS resolution failure

7 - Webhook alerts

On both plans, Guardr can POST a JSON payload to any HTTPS URL you provide when an alert fires. Configure the webhook URL in the Alerts section on the site detail page, under Webhook.

This is a generic webhook, not a Slack, Teams or Discord integration - Guardr sends a plain JSON payload with no provider-specific formatting. If you point it directly at one of those platforms' incoming webhook URLs, the raw JSON will not render as a formatted chat message, since each platform expects its own payload schema. For a formatted message in a specific chat tool, point the webhook at a relay endpoint you control that reshapes the payload for that platform.

Payload shape

Every webhook payload includes a timestamp field, plus the following per event:

Event	Additional fields
downtime	`domain`, `status_code`
recovery	`domain`, `downtime_minutes`
grade_drop	`domain`, `grade`, `previous_grade`, `score`, `new_issues`

Example payload

{
  "event": "grade_drop",
  "domain": "example.com",
  "grade": "C",
  "previous_grade": "B",
  "score": 61,
  "new_issues": [ ... ],
  "timestamp": "2026-04-18T10:00:00.000Z"
}

Requirements

The URL must be https:// - non-HTTPS URLs are rejected when you try to save them.
Guardr does not follow redirects when delivering a webhook.
Delivery times out after 5 seconds; a failed delivery is not retried.

Webhook alerts fire for the same events as email alerts: downtime, recovery and grade drops. You can have both email and webhook active simultaneously - they are independent.

8 - API keys

Free+

API keys let you query scan results and trigger scans programmatically, on every plan including Free. Keys are managed from Dashboard → Settings → API Access.

Generate a key

Go to Dashboard → Settings → API Access and click Create API key.
Enter an optional label (e.g. "CI pipeline") and click Create key.
Copy the key immediately - it is displayed only once and cannot be retrieved again.

Revoke a key

Click Revoke next to any key to invalidate it immediately. In-flight requests using the revoked key will stop working immediately.

Quotas

Guardr enforces two independent limits on API usage:

Per-domain rescan TTL. After triggering a scan for a domain via POST /v1/scan, the same key cannot rescan that domain until the TTL window expires. The window is the same on both plans:

Plan	Keys	Per-domain rescan window	Burst limit
Free	2	6 hours	60 req/min
All sites	2	6 hours	60 req/min

Burst limit. Each key is capped at a per-minute request rate regardless of domain. Exceeding either limit returns 429 with an error field of quota_exceeded or rate_limit_exceeded and a retry_after value in seconds.

Scanning multiple domains

A bulk scan endpoint is not yet available. To scan multiple domains, call POST /v1/scan in a loop with a delay between requests to stay within your burst limit.

For full endpoint documentation, authentication details and migration from SecurityHeaders.com, see the API reference.

9 - Connect via the WordPress plugin

The official Guardr plugin adds a widget to wp-admin showing your site's live grade, uptime and response time, with a one-click rescan button - no code changes, no server access. Connecting it takes three steps.

1. Install the plugin

From your WordPress admin, go to Plugins → Add New Plugin and search for "Guardr". You can also upload the plugin zip directly under Plugins → Add New Plugin → Upload Plugin. Activate it once installed - a new Guardr item appears in the wp-admin sidebar.

2. Get a token or key from your dashboard

This step happens in your Guardr dashboard rather than in WordPress and requires being logged in - it cannot be done from the plugin itself. Pick one:

Connecting one site: go to Dashboard → Settings → API Access, create a key with "Plugin-scoped key" checked, then copy it.
Connecting several sites (e.g. an agency rolling the plugin out to multiple clients): go to Dashboard → Settings → Enrollment Tokens and generate one token. The same token can be pasted into each site's plugin in turn, up to its configured use limit - you do not need a separate token per site.

Both paths end up in the same place: a permanent key bound to exactly one site, shown to you once. See enrollment token vs. API key for the full mechanics of how a token becomes a key.

3. Paste it into the plugin

In wp-admin, go to Guardr → Connect Guardr. Paste an enrollment token under "Option 1" or an existing key under "Option 2", then click Connect. WordPress sends this site's domain to Guardr's API to be scanned and monitored - no other site data is sent.

Once connected, the widget shows live data as soon as the first scan completes, typically within a few minutes. The site now scans and monitors continuously from Guardr's side, the same as any other site in your dashboard - the plugin only reads and displays that data (plus lets you trigger an on-demand rescan), it does not run the scan itself.