One scan isn't enough
A scan is a snapshot. Security is a moving target. The clean report you got last month can quietly rot by next week — and the whole problem is that nothing tells you when it does.
Fixing your hygiene once feels like closing a chapter. You added DMARC, locked down the dotfiles, set your headers — the report went green, and you moved on. The trouble is that your site didn't stop changing the moment you looked away. Every deploy, every new subdomain, every renewed (or un-renewed) cert is a chance for a hole to reopen.
Security drifts
A deploy re-opens a hole
Someone tweaks the server config, a proxy gets swapped, a framework upgrade changes defaults — and a security header you set months ago silently stops being sent.
A cert lapses
Auto-renewal fails quietly, nobody's watching the expiry, and one morning your HTTPS throws a full-page browser warning at every visitor.
A new subdomain dangles
You spin up a preview app or a status page, wire the DNS, and later tear down the service — but not the record. Now there's a takeover-prone subdomain you don't even remember making.
A secret slips into the build
A new environment file, a key hardcoded “just to test,” a build step that copies too much — and suddenly a secret is public that wasn't last time.
The drift is silent
Here's what makes it dangerous: none of these break your site. The page still loads when a header vanishes. Nothing errors when a cert has three days left or a subdomain goes orphaned. There's no alert, because from your app's point of view nothing is wrong — right up until a scanner, or a shakedown email, finds the gap you didn't know reopened.
Our own numbers say the same thing from the other direction: on the State of the Swamp page, the domains that come back and re-scan are the ones whose scores climb. Checking again is the habit that keeps the score up.
What monitoring actually does
It's not complicated: re-run the same passive checks on a schedule, and tell you the moment something flips from pass to fail — a header that disappeared, a cert winding down, a freshly dangling subdomain — so you fix it while it's a to-do instead of a screenshot in your inbox.
That's the whole idea behind our monitoring: a free monthly re-scan to catch slow drift, or paid daily checks and persistent-issue tracking if you'd rather know within a day. Set it once and let the tardigrade keep watch — being boring is a state you have to maintain, not a box you tick.
Fix it once, then keep it fixed. Start with a scan — set up monitoring from the results.
See how monitoring works →