How can we help?

Sign in, open Sites and choose Add site. Enter the address people visit, pick what it is (website, web app or REST API), then prove you own it.

Choose one: add a TXT record named _hardn-challenge.your-host with the value Hardn shows you, or put a text file at /.well-known/hardn-verify.txt containing that value. Then choose Check now.

DNS changes can take a few minutes, occasionally up to an hour. Check the record name has no doubled domain (some DNS hosts add your domain automatically), and that the value matches exactly. For the file method, the file must load over HTTPS on the same host without redirecting elsewhere.

Yes, if you're authorised to. The client (or you, with access to their DNS or hosting) adds the verification record. Agencies can keep each client in its own organisation.

Usually a few minutes. Large sites can take longer; every scan stops after 20 minutes at most.

The score starts at 100 and drops for each open problem, more for serious ones: 25 for a critical, 12 for a high, 5 for a medium and 2 for a low. A is 90 or more, B 80, C 65, D 50, and anything lower is F. Any critical issue caps the grade at D.

A public scan checks what anyone on the internet can see. A deep scan also uses test accounts you provide (their tokens or session cookies) and checks that accounts and customers can't see each other's data, and that nothing private is readable without signing in.

A finding is what one scan saw. An issue is the same problem tracked across scans: it opens when first found, stays open while scans keep finding it, and is marked fixed when a later scan no longer does.

Open the issue and choose Accept risk with a short reason. It stops counting against your score and is recorded in the audit log. You can reopen it at any time.

Yes. On a completed scan, choose Share report to create a read-only link, or Download report for a printable copy. You can turn a link off at any time.

Open the site, go to Settings, and set Monitoring to daily, weekly or monthly. Hardn re-checks ownership before each scheduled scan; each scan uses one credit.

To your organisation's owners and admins by email, and to a Slack-compatible webhook if you add one on the Notifications page. Each site chooses whether to alert on every scan or only on new issues.

Each scan uses one credit. New organisations get 3 free. A scan that fails is refunded automatically. Buy more in Billing.

Open Team and invite people by email as an admin, member or viewer. Viewers can read reports but can't start scans.

Yes, in Settings → Security. Owners can require it for everyone in the organisation.