How can we help?

Sign in, open Sites and choose Add site. Enter the address people visit, pick what it is (website, web app or REST API), then prove you own it.

Hardn looks up who runs your DNS and hosting (for example “DNS by Cloudflare, hosted on Vercel”) and shows the quickest way first. You can always choose one of three: add a TXT record named _hardn-challenge.your-host with the value Hardn shows you, put a text file at /.well-known/hardn-verify.txt containing that value, or add <meta name="hardn-site-verification" content="…"> to your home page's head. Then choose Check now.

Yes, when your DNS is at Cloudflare: choose Connect Cloudflare, create an API token from the “Edit zone DNS” template for that one domain, and paste it. Hardn adds the record, checks it and never keeps the token, so you can delete it afterwards. For DNS providers Hardn can sign in to, choose Sign in and approve access instead. Keep the record: Hardn checks it before every scan.

Use the meta tag: paste it into your site's header code (Wix: Settings → Custom code; Squarespace: Code injection; Shopify: theme.liquid, just after <head>). These platforms don't let you add a file at /.well-known/. You can also add the DNS record where your domain's DNS is managed.

DNS changes can take a few minutes, occasionally up to an hour; Hardn also asks your domain's own nameservers, so a new record usually shows within a minute. Most DNS hosts add your domain to the name for you: type only the name Hardn shows in the Name or host box, not the full name, or it ends up doubled. Check the value matches exactly. For the file and meta tag, the page must load over HTTPS on the same host without redirecting elsewhere.

Yes, if you're authorised to. The client (or you, with access to their DNS or hosting) adds the verification record. Agencies can keep each client in its own organisation.

Usually a few minutes. Large sites can take longer; every scan stops after 20 minutes at most.

The score starts at 100 and drops for each open problem, more for serious ones: 25 for a critical, 12 for a high, 5 for a medium and 2 for a low. A is 90 or more, B 80, C 65, D 50, and anything lower is F. Any critical issue caps the grade at D.

A public scan checks what anyone on the internet can see. A deep scan also uses test accounts you provide (their tokens or session cookies) and checks that accounts and customers can't see each other's data, and that nothing private is readable without signing in.

A finding is what one scan saw. An issue is the same problem tracked across scans: it opens when first found, stays open while scans keep finding it, and is marked fixed when a later scan no longer does.

Open the issue and choose Accept risk with a short reason. It stops counting against your score and is recorded in the audit log. You can reopen it at any time.

Yes. On a completed scan, choose Share report to create a read-only link, or Download report for a printable copy. You can turn a link off at any time.

Open the site, go to Settings, and set Monitoring to daily, weekly or monthly. Hardn re-checks ownership before each scheduled scan. Scheduled scans are included at your plan's frequency: monthly on Free, weekly on Solo, daily on Pro and Agency.

To your organisation's owners and admins by email, and to a Slack-compatible webhook if you add one on the Notifications page. Each site chooses whether to alert on every scan or only on new issues.

Credits pay for what your plan doesn't include: a site scan is 1 credit, a deep scan 3, an AI code review 2 to 16. Paid plans add AI review credits every month. A scan that fails is refunded automatically. Buy packs or change plan in Billing.

Open Team and invite people by email as an admin, member or viewer. Viewers can read reports but can't start scans.

Yes, in Settings → Security. Owners can require it for everyone in the organisation.