Who This Topic Is For
Site owners and agencies who need continuous visibility on a public HTTPS origin without spending scan credits on the included cadence.
Documentation
Website Watch
Set up always-on monitoring for one HTTPS origin: daily pulse, weekly Standard or Deep scan, and email when something new appears.
Prerequisites
Before You Start
Use this checklist to make sure the workflow guidance applies cleanly to your current task.
- You own the website or are authorized to monitor it.
- The origin is reachable over HTTPS (example: https://shop.example.com).
- You can complete Stripe checkout for each watched site if you do not already have an unused Watch seat.
Expectations
What To Expect
Use this section to set the right outcome before you start the workflow.
Standard or Deep at add-site, then locked
Pick Standard or Deep when you add the site. Daily pulse is the same on every seat. Quick and Comprehensive are not Watch tiers. Comprehensive, one-off dashboard scans, and add-ons stay on credits from the dashboard or Scheduled Scans.
Credits are not used for included runs
Paid active watches keep running at zero credits. The pulse and weekly Standard or Deep scan are part of the Watch seat. A weekly Deep scan can include mail-record findings from that website scan. Daily Mail Watch at $12 per mail domain is a separate product and does not run the website scanner. Manual dashboard scans still use credits as usual.
Alerts on change, not every run
The first successful runs establish a baseline and do not flood your inbox. Later runs email you when a new or worsened finding appears, the score drops past your threshold, or the certificate hits a 30, 14, 7, or expired window.
One seat per site
Standard is $29 per site per month ($290/year). Deep is $49 ($490/year). Agency Standard is $23 per site ($230/year) and the first checkout is exactly five seats ($115/month or $1,150/year). Checkout rejects fewer than five agency seats. Site six and later add one seat after you confirm the prorated charge and the new monthly or yearly total. Agency quantity stays at five or more while that subscription is active. Logged-in Watch is $79 per month or $790 per year for one origin, a weekly Deep scan, and one healthy login profile. The daily pulse stays public. If that health check fails, that week is skipped: there is no login retry and no public scan instead. It is not part of the $23 seats. A $29 seat does not cover an agency or logged-in origin. Pause keeps the seat. Watch is not gated on Pro.
Playbook
Step-By-Step Guidance
Follow these steps in order for a reliable and repeatable outcome.
Open Watch from the dashboard.
Sign in and go to /watch. The Watch item sits next to Scheduled in dashboard navigation.
The dashboard also has a Watch card that shows how many sites you are watching.
Add the HTTPS origin.
Enter a short name such as Shop production, the HTTPS URL, monthly or yearly billing, and Standard or Deep.
Click Watch website. If you already have an unused paid seat of that same depth, the site attaches to it.
If not, Stripe Checkout opens so you can add a seat.
Complete payment, then wait for the baseline.
After checkout, the watch shows as pending_payment then active.
The first pulse and first weekly Standard or Deep scan create a baseline. You should not expect an alert for every finding that already existed on day one.
Open the watch detail to see last pulse time, last weekly scan, and certificate days remaining.
Tune alerts before you treat Watch as production.
On the watch detail page, set New findings, Resolved findings, Score drop, score-drop threshold, and minimum severity. Add quiet hours in 24-hour time such as 22:00 to 07:00, a timezone such as America/New_York, and up to five extra email recipients.
Enable Weekly digest if you want a Monday 09:00 summary in that timezone.
Mute known noise, then pause or cancel with intent.
Mute an open issue when it is accepted risk or a staging quirk.
Muted fingerprints stop repeating in delta alerts. Click Unmute on that open-issue row, or in Muted issues, when you want alerts again.
Pause if you want monitoring off but the seat still occupied. Cancel if you want the seat to drop at period end.
Run pulse now is limited to once per 15 minutes. Run weekly Standard now or Run weekly Deep now is limited to once per 6 hours.
Keep Scheduled Scans for custom cadence.
Watch is the change-detection SKU.
Scheduled Scans remain the Pro-plus credit product when you need Comprehensive or a custom calendar. A pentest is a separate paid engagement.
Use Watch between those deeper tests, not instead of them.
Examples
Worked Examples
These scenarios show how the workflow looks in practice, including the result you should see.
Agency watching five client shops
Northwind Security starts Agency Standard. The first checkout is five seats at $23, so the invoice is $115 per month. They add four more origins on the unused seats with no extra charge. A sixth origin asks them to confirm Stripe’s prorated charge and the new recurring total before quantity becomes six. They can still buy a separate $29 Standard or $49 Deep seat. From an active agency seat they open a standing client page. Anyone with that link can read the latest weekly report until the site is canceled. The link is a secret. It is not the Team 14-day share.
Certificate entering the 14-day window
A pulse reports 12 days until notAfter. Watch records the tightest matching window (14 days, not 30) and sends a cert alert if that window has not already been sent. Quiet hours delay the email until 07:00 in the watch timezone.
Mute a known header gap on staging
Staging is missing HSTS on purpose. The issue appears under Open issues. You click Mute. The row shows a Muted pill and Unmute. Later pulses still see the header gap, but that fingerprint is excluded from new-finding alerts. When staging should alert again, click Unmute.
Launch freeze without losing the seat
The shop pauses Watch during a holiday freeze. Status becomes paused. Occupied seats still count that site, so billing quantity does not drop. After the freeze, Resume starts pulses again from the last baseline.
Logged-in Watch skips an unhealthy week
A $79 seat uses one login profile whose origin matches the website. Check login passed when the seat was saved. The next weekly health check fails. That week does not run a scan.
Standing client page on an agency seat
Five agency sites are active. On one shop, Save client page stores a secret link. Copy link copies it. Filling Email client changes the button to Save and email client.
A spare $29 seat does not cover an agency shop
The account already has an unused Standard seat. Adding a sixth agency origin still asks for the prorated agency charge. The $29 seat stays on Standard.
Score drop past the threshold
Score drop is on and the threshold is 10. The weekly Standard scan drops the score by 14. Quiet hours are off.
Unmute after the staging exception ends
The muted HSTS gap was accepted while staging was unfinished. The site is now production. Unmute is clicked on that open-issue row.
Validation
Validation Checklist
Use this checklist to confirm the workflow was completed correctly.
- The watch URL is HTTPS and the status is active.
- Last pulse and next pulse times appear on the watch card.
- Alert checkboxes, timezone, and quiet hours match how the team works.
- Known accepted findings are muted instead of generating repeat mail, and Unmute is available on the same watch page.
- You can explain the difference between Watch, Scheduled Scans, and a pentest.
Troubleshooting
Common Problems And Fixes
If something does not match expectation, check these common failure modes first.
Using HTTP or a path that is not the origin
Watch monitors one HTTPS origin. Use https://shop.example.com rather than http:// or a deep path. If checkout is refused, confirm the URL is publicly reachable over TLS.
Expecting Quick or Comprehensive inside Watch
Watch offers Standard or Deep for the weekly scan, chosen when you add the site. Quick and Comprehensive stay on the dashboard with credits. Scheduled Scans remain the custom-calendar credit path.
Treating pause and cancel as the same action
Pause stops runs but keeps the paid seat. Cancel ends the watch and drops the seat at period end without a mid-cycle refund.
Assuming zero credits will block Watch
Included Watch runs skip credit deduction. Zero credits still fire pulse and weekly Standard or Deep on a paid active watch.
Agency checkout rejected four sites
Agency Standard starts at five seats. Quantity 1 through 4 is refused. The first invoice is five times $23, which is $115 per month or $1,150 per year.
Logged-in Watch saved before the login check passed
Watch website stays disabled until Check login reports Login check passed and the profile origin matches the website. A failed weekly check later skips that week only.
Navigate
Related Pages
Use these links to continue your workflow without losing context.
Website Watch product page
Open Website Watch product page to continue this workflow.
Help: Website Watch
Open Help: Website Watch to continue this workflow.
Automation And Integrations
Open Automation And Integrations to continue this workflow.
Plans, Credits, And Billing
Open Plans, Credits, And Billing to continue this workflow.
Pricing
Open Pricing to continue this workflow.
FAQ
Website Watch FAQs
Common questions for this topic.
No. Included daily pulse and weekly Standard or Deep runs always fire on a paid active watch, even at zero credits. Comprehensive, one-off dashboard scans, and add-ons stay on credits.
Next Recommended Action
Continue to the best next page based on where you are in your workflow.