Who This Topic Is For
Users who already added or tried to add a watched site and need the next operational step or a fix for missing alerts.
Help
Website Watch Help
Troubleshoot Watch billing, missing alerts, mutes, quiet hours, pause versus cancel, and how Watch differs from Scheduled Scans.
Prerequisites
Before You Start
Use this checklist to make sure the workflow guidance applies cleanly to your current task.
- You can sign in and open /watch.
- You know the HTTPS URL you intended to monitor.
- You can see the watch status pill or the error shown when Watch website failed.
Expectations
What To Expect
Use this section to set the right outcome before you start the workflow.
No mail on the first clean baseline
If the first runs only record what was already there, Watch stays quiet. Alerts start when something new appears, the score drops, or a cert window is hit.
Pulse is lighter than the weekly scan
Daily pulse covers headers, certificate days, mixed content, HTTP to HTTPS, and common exposed paths. Weekly Standard or Deep is the matching dashboard pack, locked for that seat. Pulse will not look like a ZAP-backed full scan.
Manual runs are rate-limited
Run pulse now at most once per 15 minutes. Run weekly Standard now or Run weekly Deep now at most once per 6 hours. Scheduled included runs still follow the daily and weekly cadence.
Agency and logged-in seats stay separate
Agency Standard starts at five sites. Logged-in Watch is one origin at $79 and needs a passing login check. A spare $29 seat does not cover either of those.
Playbook
Step-By-Step Guidance
Follow these steps in order for a reliable and repeatable outcome.
Confirm the watch exists and is active.
Open /watch and click the site.
Status should be active. pending_payment means checkout is not finished.
paused means you stopped runs on purpose. past_due means billing needs the Manage billing portal.
Read last pulse, last full, and certificate days.
If last pulse is empty, the runner has not completed a pulse yet. If last weekly scan is empty, the weekly Standard or Deep scan has not landed.
Certificate days and last window explain whether a cert alert should already have been sent.
Check alert settings before assuming mail failed.
Confirm New findings, Score drop, minimum severity, quiet hours, timezone, extra recipients, and Weekly digest. A High minimum severity will skip a Low header finding.
Quiet hours delay rather than drop the event.
Inspect Open issues and mutes.
If the finding is listed and you previously clicked Mute, alerts for that fingerprint will not repeat. Click Unmute on the open-issue row or in Muted issues to restore alerts for that fingerprint only.
Do not confuse Watch with Scheduled Scans or credits.
Custom cadence and Comprehensive still live under Scheduled Scans and the dashboard.
Watch included runs do not deduct credits. If a credit Comprehensive did not run, that is not a Watch defect.
If weekly Deep did not run, confirm the seat is Deep, not Standard.
Examples
Worked Examples
These scenarios show how the workflow looks in practice, including the result you should see.
Alert missing during quiet hours
Quiet hours are 22:00 to 07:00 America/New_York. A pulse at 01:10 finds a new exposed path. Mail does not arrive at 01:10. It arrives after 07:00.
Checkout blocked because billing is not configured
Watch website returns Watch billing is not configured instead of a Stripe URL. Price IDs are not live for this environment. The site is not watching yet and no seat was added.
Zero credits, Watch still green
The account credit balance is 0. The watch stays active. Next pulse and weekly Standard or Deep still run. A teammate then starts Comprehensive from the dashboard and is blocked until they buy credits.
Operations
Operational Playbook
Use this long-form guidance to execute the workflow consistently across planning, implementation, and validation.
One question per seat
Website Watch asks whether this HTTPS origin changed in a way you asked to hear about. It is not a pentest. Quick and Comprehensive are not Watch tiers. Daily pulse is the same on every seat, and Standard or Deep is locked when you add the site.
The first day stays quiet
The first pulse and weekly scan record what already exists. Vulnify does not email that history. Later mail covers new or worse findings, resolved findings when that setting is on, a score drop past the threshold, and certificate windows at 30, 14, 7, and expired.
Seats stay occupied on purpose
Pending payment, active, paused, and past due all occupy a seat. Pause stops pulses and keeps the seat. Cancel drops it at the end of the term. Agency Standard starts at five seats, $23 each. A spare $29 seat does not cover an agency origin.
Site six confirms the new total
The first five agency origins do not open a new checkout. Adding a sixth site asks you to confirm the prorated charge and the new recurring total. Quantity does not fall below five while that subscription is active.
Logged-in Watch is a separate seat
Logged-in Watch is $79 per month or $790 per year. Check login must pass, and the profile origin must match the site, before the seat saves. If the weekly health check fails, that week is skipped. There is no login retry and no public scan instead.
Mute the issue, not the product
Mute one fingerprint when you accept the risk. It stays visible with a Muted pill and drops out of new-finding mail until you unmute. Quiet hours delay alerts until the window ends. Do not turn off New findings to silence one issue.
Validation
Validation Checklist
Use this checklist to confirm the workflow was completed correctly.
- Watch status is active or the billing state is understood.
- Last pulse or last full time is present after a reasonable wait.
- Alert checkboxes and quiet hours match the missing-mail theory.
- The missing finding is not muted and meets minimum severity. If it is muted, Unmute it from Open issues or Muted issues.
- The requested depth matches the locked Watch seat (Standard or Deep). Comprehensive is a credit scan.
Troubleshooting
Common Problems And Fixes
If something does not match expectation, check these common failure modes first.
No email after adding the site
The baseline is quiet on purpose. Wait for a later pulse or weekly Standard or Deep scan, or click Run pulse now after the 15-minute limit. Confirm the watch is active and not paused.
HTTP URL rejected
Use an HTTPS origin. Watch is not a scanner for plain HTTP sites.
Pause dropped monitoring but billing stayed
That is correct. Pause occupies the seat. Cancel if the site should leave quantity at period end.
Weekly Standard or Deep looks different from a pulse
Expected. Pulse is a lightweight daily check. Weekly Standard or Deep is the matching dashboard pack and appears in scan history when a scan_id is present.
Manual run says action failed immediately after the last click
Honor the 15-minute pulse and 6-hour full limits. The included daily and weekly schedule is separate from those manual buttons.
Muted a finding by mistake
Open the watch and click Unmute on that open-issue row, or under Muted issues. You do not need support to clear a mute.
Navigate
Related Pages
Use these links to continue your workflow without losing context.
Documentation: Website Watch
Open Documentation: Website Watch to continue this workflow.
Website Watch product page
Open Website Watch product page to continue this workflow.
Help: Billing And Credits
Open Help: Billing And Credits to continue this workflow.
Documentation: Automation And Integrations
Open Documentation: Automation And Integrations to continue this workflow.
Contact Support
Open Contact Support to continue this workflow.
FAQ
Website Watch Help FAQs
Common questions for this topic.
The first successful runs set a baseline so Watch does not spam existing findings. Alerts start when something new appears, the score drops, or a certificate window is reached.
Next Recommended Action
Continue to the best next page based on where you are in your workflow.