Getting started

Guardr scans your site externally - no code changes, no agents, no server access required. This guide walks you through adding a site, reading your security score and setting up alerts so you know the moment something changes.

1 - Add your first site

From the dashboard, click Add site and enter your domain - for example example.com. You do not need to include https://. Guardr normalises the input and begins a full external scan immediately.

The first scan typically completes within 5 seconds. Once done, your site appears in the dashboard with an A–F security grade and a list of findings sorted by severity.

Free plan: all findings are visible with severity labels and descriptions. Fix instructions are shown in full for the first 2 findings so you can see exactly what Guardr provides. Fix instructions for all remaining findings are available on Solo+.

Each plan has a site limit. You can manage or remove sites at any time from Dashboard → Sites.

Plan	Sites	Scan frequency	History
Free	1	Weekly	7 days
Solo	5	Daily	14 days
Starter	15	Daily	30 days
Pro	50	Every 6 hours	90 days
Agency*	150	Hourly	1 year

* Agency is waitlist-only and not yet available for self-serve signup.

2 - Changing or cancelling your plan

Downgrading to a plan with a lower site limit never auto-deletes or deactivates any of your existing sites - they keep scanning and monitoring exactly as before. The only effect is on adding: you're blocked from adding a new site or restoring a site from the recycle bin until you're back under your new plan's limit. Remove or keep enough sites to get under the limit first, then add or restore as normal.

Cancelling keeps your paid plan's features active until the end of your current billing period. When that period ends, your account automatically reverts to the Free plan - there is no immediate loss of access the moment you cancel.

3 - Understanding your security score

Every site receives a letter grade from A (best) to F (worst), calculated from a weighted score across five scan categories. The numeric score runs 0–100.

Category	Weight	What is checked
TLS / SSL	28%	HTTPS enforcement, HTTP→HTTPS redirects, HSTS header, redirect chain depth, certificate expiry
Security headers	28%	Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy
Exposure paths	20%	Publicly accessible .git, .env, phpinfo.php and other sensitive paths
Cookie security	14%	Secure flag, HttpOnly flag and SameSite attribute on authentication and session cookies
DNS security	10%	DNSSEC validation, CAA records (checked via DNS-over-HTTPS)

In addition to the graded categories, Guardr scans your live JavaScript bundles for exposed API keys - OpenAI, Anthropic, Stripe (live keys), AWS access keys, Google AI / Gemini keys and Supabase service_role JWTs. A confirmed critical-severity secret (OpenAI, Anthropic, Stripe, AWS and Supabase service_role keys) drops the exposure score to 0. A confirmed high-severity secret (Google AI / Gemini keys) caps the exposure score at 20 instead. Either will lower your overall grade.

Free plan - what "Basic security score" means: you receive the full A–F grade, numeric score and complete findings list with severity labels and descriptions. Fix instructions - including effort level (quick fix, some setup, plan carefully) and platform-specific code snippets for Cloudflare, Nginx and Apache - are shown in full for the first 2 findings. Fix instructions for all remaining findings require Solo+.

The grade thresholds and per-category scoring weights are documented in detail on the Methodology page.

Reading the findings list

Each finding shows its severity (critical, high, medium or low), the affected category, a plain-English description of the risk and an effort indicator - Quick fix, Some setup or Plan carefully - so you know what you are committing to before you start. On Solo+ plans, each actionable finding also includes platform-specific code snippets for Cloudflare, Nginx and Apache. Apply the fix for your platform and re-scan to confirm the issue is resolved.

4 - Configure alerts

Guardr sends email alerts when your site changes state. Alerts are configured per site from the Alerts section on the site detail page. Each alert type has an independent cooldown to prevent repeated notifications for the same condition.

Alert types

Alert	Plan	Trigger
Downtime	Free+	3 out of 3 global regions confirm the site is unreachable (see Uptime monitoring)
Recovery	Free+	Site returns to reachable after a confirmed outage
Grade drop	Solo+	Security grade drops by one or more levels (e.g. B → C)
SSL expiry	Solo+	TLS certificate expires within 30 days (first alert) or 7 days (second alert)
Weekly summary	Free+	Scheduled weekly digest of score, top issues and SSL status - content varies by plan

The 30-day and 7-day SSL expiry triggers are tracked and re-alerted independently, not as a single combined alert - the 30-day warning re-alerts every 14 days it remains true, and the 7-day warning re-alerts every 3 days, so you can receive both as a certificate approaches expiry.

What a grade-drop alert contains

When Guardr detects a grade drop, the email includes:

• The old and new grade (e.g. C → C-)
• A list of newly detected issues since the previous scan
• The new numeric score and detection timestamp
• A View Details link to your dashboard where you can open the site and review the scan history

5 - Uptime monitoring

Guardr probes each site on a regular interval using an HTTP HEAD request with a GET fallback. The probe interval depends on your plan.

Plan	Probe interval
Free	Every 5 minutes
Solo	Every 5 minutes
Starter	Every 3 minutes
Pro	Every 1 minute
Agency*	Every 1 minute

* Agency is waitlist-only and not yet available for self-serve signup.

How outage confirmation works

A single failed probe does not trigger an alert. On the first failure, Guardr fans out to three independent Durable Object probes in separate global regions:

• US East
• Western Europe
• Asia Pacific

All three regions must confirm the failure (3/3) for Guardr to record a real outage and fire an alert. If any of the three regions doesn't confirm the failure, the check is recorded as a transient blip and no alert fires. This prevents false alarms from regional network issues or brief WAF responses.

Once monitoring has started, a 3-region verified badge appears in the uptime dashboard to indicate that the monitoring system uses multi-region confirmation.

Response codes

Not every non-200 response means the site is down. Guardr treats the following codes as expected behaviour and records the site as UP:

• 403, 429, 503 - WAF blocks, rate limits and maintenance responses
• 520, 521, 522, 524, 527 - Cloudflare transient errors (not alerted)

The following codes are treated as real failures that contribute to outage confirmation:

• 523 - Origin unreachable
• 525, 526 - Invalid or expired SSL certificate
• 530 - DNS resolution failure

6 - Webhook alerts

Pro+

On Pro and Agency plans, Guardr can POST a JSON payload to any HTTPS URL you provide when an alert fires. Configure the webhook URL in the Alerts section on the site detail page, under Webhook.

This is a generic webhook, not a Slack, Teams or Discord integration - Guardr sends a plain JSON payload with no provider-specific formatting. If you point it directly at one of those platforms' incoming webhook URLs, the raw JSON will not render as a formatted chat message, since each platform expects its own payload schema. For a formatted message in a specific chat tool, point the webhook at a relay endpoint you control that reshapes the payload for that platform.

Payload shape

Every webhook payload includes a timestamp field, plus the following per event:

Event	Additional fields
downtime	domain, status_code
recovery	domain, downtime_minutes
grade_drop	domain, grade, previous_grade, score, new_issues

Example payload

{
  "event": "grade_drop",
  "domain": "example.com",
  "grade": "C",
  "previous_grade": "B",
  "score": 61,
  "new_issues": [ ... ],
  "timestamp": "2026-04-18T10:00:00.000Z"
}

Requirements

• The URL must be https:// - non-HTTPS URLs are rejected when you try to save them.
• Guardr does not follow redirects when delivering a webhook.
• Delivery times out after 5 seconds; a failed delivery is not retried.

Webhook alerts fire for the same events as email alerts: downtime, recovery and grade drops. You can have both email and webhook active simultaneously - they are independent.

7 - API keys

Free+

API keys let you query scan results and trigger scans programmatically, on every plan including Free. Keys are managed from Dashboard → Settings → API Access.

Generate a key

1. Go to Dashboard → Settings → API Access and click Create API key.
2. Enter an optional label (e.g. "CI pipeline") and click Create key.
3. Copy the key immediately - it is displayed only once and cannot be retrieved again.

Revoke a key

Click Revoke next to any key to invalidate it immediately. In-flight requests using the revoked key will stop working immediately.

Quotas

Guardr enforces two independent limits on API usage:

Per-domain rescan TTL. After triggering a scan for a domain via POST /v1/scan, the same key cannot rescan that domain until the TTL window expires. The window varies by plan:

Plan	Keys	Per-domain rescan window	Burst limit
Free	1	7 days	5 req/min
Solo	1	24 hours	15 req/min
Starter	1	24 hours	30 req/min
Pro	2	6 hours	60 req/min
Agency*	5	1 hour	120 req/min

* Agency is waitlist-only and not yet available for self-serve signup.

Burst limit. Each key is capped at a per-minute request rate regardless of domain. Exceeding either limit returns 429 with an error field of quota_exceeded or rate_limit_exceeded and a retry_after value in seconds.

Scanning multiple domains

A bulk scan endpoint is not yet available. To scan multiple domains, call POST /v1/scan in a loop with a delay between requests to stay within your burst limit.

For full endpoint documentation, authentication details and migration from SecurityHeaders.com, see the API reference.

8 - Connect via the WordPress plugin

The official Guardr plugin adds a widget to wp-admin showing your site's live grade, uptime and response time, with a one-click rescan button - no code changes, no server access. Connecting it takes three steps.

1. Install the plugin

From your WordPress admin, go to Plugins → Add New Plugin and search for "Guardr", or upload the plugin zip directly under Plugins → Add New Plugin → Upload Plugin. Activate it once installed - a new Guardr item appears in the wp-admin sidebar.

2. Get a token or key from your dashboard

This step happens in your Guardr dashboard, not in WordPress, and requires being logged in - it cannot be done from the plugin itself. Pick one:

• Connecting one site: go to Dashboard → Settings → API Access, create a key with "Plugin-scoped key" checked, and copy it.
• Connecting several sites (e.g. an agency rolling the plugin out to multiple clients): go to Dashboard → Settings → Enrollment Tokens and generate one token. The same token can be pasted into each site's plugin in turn, up to its configured use limit - you don't need a separate token per site.

Both paths end up in the same place: a permanent key bound to exactly one site, shown to you once. See enrollment token vs. API key for the full mechanics of how a token becomes a key.

3. Paste it into the plugin

In wp-admin, go to Guardr → Connect Guardr. Paste an enrollment token under "Option 1", or an existing key under "Option 2", and click Connect. WordPress sends this site's domain to Guardr's API to be scanned and monitored - no other site data is sent.

Once connected, the widget shows live data as soon as the first scan completes, typically within a few minutes. The site now scans and monitors continuously from Guardr's side, the same as any other site in your dashboard - the plugin only reads and displays that data (plus lets you trigger an on-demand rescan), it does not run the scan itself.