Start your 7-day free trial, card not charged until it ends

Website security monitoring

Website security monitoring that spots the warning signs

Website security monitoring watches a site for signs that something is wrong. TLDTrack checks your domain against Google's malware and phishing lists and 12 spam blacklists, alerts you to DNS changes and new WordPress admins, and runs security scans when you need them that grade your headers, TLS and exposed files.

Start your free trial See how it works

Card not charged until your trial ends

01 · Watched

Checked for you, on a schedule

Twice a week

Google malware and phishing flags

Your homepage address is looked up in Google Web Risk, the commercial version of Safe Browsing, for malware, phishing and unwanted software. You get an alert by email, push, Slack or Teams when it is flagged, and again when it is cleared.

Every 12 hours

Blacklist listings

Each domain, and the IP address its website runs on, is checked against 12 DNS blacklists including Spamhaus, SURBL, SpamCop and Barracuda, with an alert when it is listed and an all-clear when it comes off.

Every few hours

DNS changes

The A, AAAA, MX, NS, CNAME and TXT records on the domain are read again, and any record added or removed raises an alert that names it. A changed nameserver or mail record is often the first sign a domain has been tampered with.

With the plugin

New WordPress admins and plugins

A new administrator account is a critical alert. Plugins installed or removed are flagged too.

Hourly to weekly

Security headers and exposed pages

Content checks confirm HSTS, Content-Security-Policy and X-Frame-Options are still sent, HTTP still redirects to HTTPS, pages load no insecure content, and wp-login.php is not open to anyone.

Hourly to weekly

Visible changes

Visual monitors compare the pages you choose with an approved baseline, so a defaced page or an unexpected banner shows up as a change.

02 · Scans

Security scans

Run a scan on a site when you need the full picture. Scans run when you start them and use credits.

  • Security headers: HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy
  • TLS configuration, tested with testssl.sh
  • Version leaks in Server and X-Powered-By headers, cookie flags and CORS settings
  • A port scan of the 100 most common ports
  • 21 probes for exposed files such as .env, .git, config backups, phpinfo and SQL dumps
  • Known issues from Nuclei templates and OWASP ZAP
  • WPScan when the site runs WordPress
  • SPF, DKIM and DMARC records

Each scan gets a grade from A+ to F, a plain-English summary with fixes, and a PDF report.

03 · Cost

Plans and credits

2

credits for a Baseline scan

A Baseline scan uses 2 credits. A Full scan, which adds subdomain discovery, uses 8. Credits come from your monthly allowance, and extra packs are available. The malware, DNS, WordPress and content checks above use no credits.

Starter250 credits a month
Pro1,250 credits a month
Agency5,000 credits a month
FreeNo scans

04 · Pricing

Simple, transparent pricing

Every paid plan starts with a 7-day free trial. Cancel during the trial and you won't be charged.

Free forever

Free

Monitor one site, free forever

$0/mo

1 website + 4 extra monitors

No credit card needed

  • Uptime checks every 5 minutes
  • Response time tracking
  • Domain expiry alerts
  • SSL certificate expiry alerts
  • Email alerts
Start free

7 days free

Starter

For individuals & small portfolios

$11/mo

Up to 5 websites

250 monitoring credits / month

  • Uptime, SSL, DNS & blacklist
  • Content & visual change monitoring
  • Accessibility (WCAG 2.2) monitoring
  • Email health & renewal alerts
  • PageSpeed & malware scanning
  • Free WordPress plugin
  • WHM & cPanel monitoring
  • Bulk import & export
  • Security, SEO & compliance scans
  • AI integration (Claude & ChatGPT)
Start free trial

Most popular

Pro

For active managers & agencies

$29/mo

Up to 25 websites

1,250 monitoring credits / month

  • Everything in Starter
  • Up to 5 team members
  • Client report builder
  • AI search visibility
  • Priority support
  • Security, SEO & compliance scans
  • AI integration (Claude & ChatGPT)
Start free trial

7 days free

Agency

For large portfolios & teams

$89/mo

Up to 100 websites

5,000 monitoring credits / month

  • Everything in Pro
  • Up to 20 team members
  • Agency CRM & white-label reports
  • Security, SEO & compliance scans
  • Dedicated support
  • AI integration (Claude & ChatGPT)
Start free trial

Bigger than 100 websites? Our Enterprise plan adds unlimited sites, custom data residency, an SLA, dedicated onboarding and custom integrations. Talk to us

*SMS alerts are an optional add-on on paid plans for UK mobile numbers, paid for with prepaid SMS credit packs. Prices exclude any applicable sales tax. Your card won't be charged during a paid-plan trial. Cancel anytime.

05 · Questions

Frequently asked questions

Does TLDTrack scan my files for malware?

No. It checks whether Google has flagged your domain for malware, phishing or unwanted software. It does not read your files or page code looking for infections.

Do security scans run automatically?

No. Scans run when you start one, and their findings are in the report rather than sent as alerts. The malware, DNS, WordPress and content checks run on their own schedule.

Will my firewall block the scanner?

It can. Before each scan TLDTrack checks whether a firewall is likely to get in the way. If it is, allowlist the scanner IP, 18.135.126.230.

Which plans include security scans?

Starter, Pro and Agency. The Free plan covers uptime, SSL and domain expiry only.

What should I do if a site has already been hacked?

Clean it up first, then put checks in place to catch it happening again. Our guide to monitoring a website after a hack lists what to switch on.
Mark Grice, founder of TLDTrack

Mark Grice, founder of TLDTrack. Runs FullyCoded, a Cornwall web agency, and built this to keep 500+ client sites in front of him every day.

What happens next

Put the checks on your sites

Do it yourself

Start your free trial

Add your sites, switch on the checks each one needs and TLDTrack does the watching. Your card is not charged for 7 days.

Start your free trial

Talk it through

Arrange a call with Mark

If you would rather talk through how this works across every site you look after, we can go through it together.

Book a call

See every check TLDTrack runs