Repeatable external assessments across sites you maintain

Assessing a domain you do not own requires that domain's owner's authorisation. This is a legal and contractual matter, not a preference, and it is the client's to give. The Terms of Service make it your responsibility as a matter of contract, whether or not the tool asks for proof.

The practical version: get it in writing, scope it, and keep it. The things worth having in that document are the domains, the date range, and permission for the requests described in the methodology — which is a short list, because the method is read-only, uses no credentials and refuses to send a state-changing request. A client who reads that section is far more likely to sign than one handed an NDA.

For sites you host or build for a client, the domain ownership verification step does double duty: it is how the full check surface is unlocked, and it is a durable artefact in the client's DNS that evidences that the client authorised the assessment. Put the verification record in the handover documentation and it becomes part of the estate record rather than something you re-do per client.

Tell the client's host or WAF provider before you scan. Assessment traffic is ordinary visitor traffic and can trip rate limiting, WAF rules or intrusion detection. A scan that gets the client's site rate-limited is a conversation you did not need to have.

An agency's deliverable is a document an outsider has to accept. That makes three properties matter more than the number of checks:

Evidence

Every finding carries the observation that produced it — the record, the header, the response — so a client's developer can verify it rather than take it on trust, and so you are not the one being asked to defend an assertion.

Calibration

Severity and confidence are separate. A confirmed finding and a pattern that merely suggests one are graded differently and presented differently, so a client can tell what to fix tonight from what to look at. A report that lists everything at one level gets ignored.

Comparability

The method is bounded and stated, so a re-run is comparable to the last one. That is what turns a series of assessments into evidence of change, which is what a maintenance contract is actually selling.

The full example report is a real assessment of a domain we own, published in full — the fastest way for a client to see the level of detail before asking for it.

Baseline. Assess every domain in the estate. For sites you built, the first report usually finds things you did not know about — a staging hostname, a backup in the document root, a debug header left on in production. Treat that as an asset-management problem as much as a security one.

Remediate. Hand the report over. Findings carry the specific change, not just the name of the control, so a client's developer can act on most of them without a conversation.

Re-assess. Re-run and produce the difference. This is the step that distinguishes an assessment from a snapshot, and the one that justifies a recurring engagement: the second report is a statement about what changed and whether the change worked, which is defensible in a way that "our posture is good" is not.

Cadence. Re-run after every change to anything a domain touches, and on a schedule regardless — quarterly is a defensible default for sites that do not change often, and the plan's automatic re-assessment exists for that. The point is that the schedule is explicit rather than "when someone remembers".

Keep the reports. A report from eighteen months ago is worth more in a dispute than a new one, because it shows what was known when. Free-plan history is 30 days; the paid plans keep more, and PDF export exists so a report can live in the client's own systems.

The plan allowances are on the pricing page and are not restated here, because they change and a stale number on this page would be a number you quoted to a client and were wrong about. What is worth knowing is the shape: allowances are counted per account across every domain on it, so a portfolio is one account with several domains rather than several accounts.

The Business plan adds an executive summary, which is a different artefact for a different reader — the person who signs the maintenance contract is not the person who fixes the headers, and one report rarely serves both.