Skip to main content

Know the day your website’s security changes

Guard rescans your domain every morning and emails you when something material changes: an expiring certificate, a removed security header, tracking that starts before consent, a weakened email policy. Everything else is kept in a dated history you can hand to an auditor.

Start monitoring — €25/monthSee two weeks of alerts

Incl. 21% VAT. Cancel anytime. No agent, no account.

    • HighSecurity headersRemoved

      Strict-Transport-Security header removed

      Browsers are no longer forced onto HTTPS, which re-opens SSL-stripping attacks on public Wi-Fi.

      Item
      Strict-Transport-Security
      Before
      max-age=31536000; includeSubDomains
      After
      Not present

    • LowSecurity scoreChanged

      Security score dropped 4 points

      The overall security posture weakened since the previous scan. Risk level moved from low to medium.

      Item
      Overall score
      Before
      77/100 (low)
      After
      73/100 (medium)
The 2 November scan in the console · Sample account, fictional data for northwind-freight.example

northwind-freight.example

Monitoring activeDaily scansSince 20 Oct 2026

Security score
73MediumDown 1 since 20 Oct 2026
Score over time
20 Oct 2026Start 743 Nov 2026
Last scan
3 Nov 2026, 06:10 UTC
Next scan
4 Nov 2026, 06:10 UTC

17 changes since the baseline across 15 scans

  • High4
  • Medium2
  • Low4
  • Info7
Monitoring console overview for the same sample account.

Two weeks of northwind-freight.example

A freight company with a busy marketing team and an outsourced mail provider. Nothing was attacked; ordinary work changed its public security five times in a fortnight.

daily scans
15
alert emails
5
routine changes logged quietly
3
  1. Day 323 Oct

    A staging host went public

    A certificate for staging.northwind-freight.example appeared in Certificate Transparency logs. Test systems are rarely hardened, so this is worth knowing the day it goes public.

  2. Day 525 Oct

    The redesign dropped the cookie banner

    The new site launched with Google Analytics and a new Meta Pixel setting cookies before any consent. Under GDPR and ePrivacy those cookies need consent first.

  3. Day 727 Oct

    A mail-provider switch opened the door to spoofing

    DMARC went from reject to none during the migration, so mail forged in the company’s name would reach customers’ inboxes again.

  4. Day 929 Oct

    The certificate was 13 days from expiry

    Auto-renewal had silently failed. It was renewed two days later, well before browsers would have started warning visitors.

  5. Day 1030 Oct

    The fixes were confirmed, with dates

    The banner came back, DMARC returned to reject and the score recovered 9 points. The timeline now shows when each gap opened and closed.

  6. Day 132 Nov

    A CDN change removed HSTS

    Browsers were no longer forced onto HTTPS. Nobody had touched the website itself; a daily check notices this, a yearly audit would not.

2 Nov 2026Monday2 changes

31 Oct 2026Saturday1 change

30 Oct 2026Friday4 changes

29 Oct 2026Thursday1 change

27 Oct 2026Tuesday2 changes

    • HighEmail authenticationChanged

      DMARC policy weakened from reject to none

      Mail that fails authentication is no longer blocked, so phishing from your domain reaches inboxes.

      Item
      DMARC
      Before
      reject
      After
      none

    • LowEmail authenticationAdded

      DMARC reports sent to a new address

      Aggregate reports reveal which servers send mail as your domain; make sure the recipient is yours or a trusted vendor.

      Item
      DMARC reporting
      Before
      dmarc@northwind-freight.example
      After
      dmarc@northwind-freight.example rua@reports.mailrelay.example

25 Oct 2026Sunday4 changes

23 Oct 2026Friday2 changes

22 Oct 2026Thursday1 change

20 Oct 2026TuesdayBaseline

Change history, newest first. Open any scan to see what changed, before and after.

The email that lands on day 5

Written for the person who has to act on it: what changed, how serious it is, the value before and after, and why it matters. One email per scan at most, and only when something material changed.

  • Severity first, so a high alert never hides behind routine edits
  • Before and after values for every change
  • Links to the full timeline and the latest report
  • Routine changes such as CDN rotation, certificate renewals and text edits never send an email on their own
Subject: Security Alert: northwind-freight.example – Cookie consent banner no longer detected
OffSeq Guard Monitoring alert

northwind-freight.example

HIGH
Scanned 2026-10-25 06:10 UTC

northwind-freight.example: Cookie consent banner no longer detected and 3 more changes.

High · 1
  • Cookie consent banner no longer detected
    Analytics or marketing cookies are set on the first visit (Google Analytics, Meta Pixel), now without any consent request.
    Before
    Consent banner (Cookiebot)
    Now
    No consent banner
Medium · 1
  • New tracker: Meta Pixel
    Sends visitor data to a third party; under GDPR and ePrivacy it must only load after consent.
    Now
    connect.facebook.net
Low · 1
  • Security score dropped 6 points
    The overall security posture weakened since the previous scan.
    Before
    74/100 (medium)
    Now
    68/100 (medium)
Info · 1
  • Minor text edits (+14 / −6 words)
    Visible copy on the page changed since the previous scan.
    Northwind Freight moves pallets temperature-controlled freight across the Baltics and Nordics. Track every shipment live in the new customer portal. Request a quote …

Guard scans northwind-freight.example daily and emails you when something changes. Manage recipients or cancel.

Replies go to guard@offseq.com.
The real alert template, filled with the sample data.

What Guard compares every day

Every area of the free scan, rescanned and diffed against the previous day.

TLS certificate
Expiry countdown, issuer changes, weak keys, self-signed or invalid certificates, new certificates for your subdomains.
DNS
Website moved to new IP addresses, nameserver or mail-server changes, CAA and DNSSEC. CDN rotation is logged, not alerted.
Email authentication
SPF, DKIM and DMARC weakened or removed, new DMARC report recipients, MTA-STS.
Security headers
HSTS, Content-Security-Policy, X-Frame-Options and others removed or weakened, with what each change re-opens.
Trackers and consent
Consent banner removed, tracking cookies set before consent, new trackers and script hosts on your pages.
Subdomains
New hosts from DNS and Certificate Transparency, with admin, staging and backup hosts flagged.
Exposed services
Newly reachable ports and services, such as databases or remote desktop.
GDPR and NIS2 posture
Score movements per area and new or resolved findings, so the evidence stays current.
Page content
Word-level diffs of visible text and headings, to catch defacement or unapproved edits.

Start monitoring your domain

€25per domain per month

  1. Subscribe in a minute

    Enter the domain and the address for alerts, then pay by card. No account, no agent to install, nothing changes on your site.

  2. Baseline within minutes

    Guard runs a full scan and stores it as the reference. You get a welcome email with the baseline score.

  3. A check every morning

    Each day’s scan is compared with the last. Material changes are emailed; everything is kept in a dated history you can export as CSV or JSON.

Want to see your own baseline first? Run a free scan; monitoring can be started from the report.

incl. 21% VAT. Billed monthly to your card; cancel from the management link at any time.

VisaMastercardCard payment · secure checkout by Mollie

Questions about monitoring

What it watches, how often it writes and how billing works.

The free scan is a snapshot of one moment. Monitoring repeats it every day, compares each result with the previous one and tells you what changed, so you hear about an expiring certificate or a removed header before a customer, auditor or attacker does.