Documentation
Getting started
From a domain to a verified fix. The screen and button names below are the ones you see in the app.
STEP 1
Add a target
Open Targets and choose Add target. Enter the origin of a site you own or are authorised to test — scheme and host only, for example https://www.example.com, with no path and no query. Select Register and continue.
Registering sends nothing to the site. No request is sent until ownership is proven and permission is recorded.
What an exact origin means
- Subdomains, including ones found during a scan, are not covered; each needs its own target.
- http:// is never scanned; only https:// is accepted.
- Other ports are other origins.
- Redirects to another host are not followed.
STEP 2
Prove ownership
On Prove ownership, pick one method and select Create verification value. The value is created for this origin, shown once and valid for 10 minutes, with up to 5 checks. Publish it, then select Check now. Each check is one explicit request to the origin.
DNS TXT record
Whoever manages DNS · usually 1–10 min
Add a TXT record with the name shown, for example _trustpect-challenge.www.example.com, and the verification value as its content.
HTML file
Web server or hosting panel · right after upload
Create the file at exactly the address shown, under /.well-known/trustpect-ownership/. Serve it over HTTPS with status 200 and no redirect.
HTML meta tag
CMS or theme editor · after a cache purge
Add the trustpect-verification meta tag shown to the <head> of the page at the origin’s root address, then purge the cache.
When the check passes you see Ownership verified and the date the proof is valid until. Keep the value published; it is checked again before the proof expires. Proving ownership does not start or allow a scan.
STEP 3
Give permission
Open Permission and controls and select Give permission. Choose the scan profile — it limits methods, paths and request budget — and a duration that ends before the ownership proof expires. Read the Permission statement, confirm both statements and select Record permission.
Permission does not start a scan. Revoke permission stops new requests under it at once; you can give a new permission later.
The emergency stop and the scan window are separate controls on the same screen.
STEP 4
Run the first scan
Select Start a scan. Before anything runs you see the estimate — requests, duration and the controls planned. Confirm it in Start this scan?.
- A scan runs only while ownership proof and permission are valid, the emergency stop is off and the scan window is open.
- Turn on emergency stop at any time and nothing more is sent.
- Reaching a budget limit stops the scan and labels it partial.
STEP 5
Follow a finding through its life
Every finding comes with its evidence — the request, the response with secrets masked, and how certain the result is — and a fix for your stack. In Findings, its status is one of these:
| Status | What it means |
|---|---|
| Open | A check reproduced the issue. |
| Fix claimed | You reported a fix. It is not verified yet and stays open. |
| Retest pending | The retest is queued or running. |
| Resolved | An equivalent retest could no longer reproduce it. |
| Reopened | A later scan saw it again. |
| Risk accepted | Accepted for a set period with a reason; it comes back for review when the period ends. |
| False positive | Marked as not a real issue, with a reason. |
| Suppressed | Hidden by a scope rule; it returns if the rule is removed. |
STEP 6
Close a finding with a retest
After you deploy a fix, open the finding and select I fixed it — retest. The check that found the issue runs again at the same location, with equivalent scope and the same role. There are three possible results:
- Closed — the check could not reproduce it. The fix is verified for this check. If a later scan sees it again, the finding reopens.
- Not closed — still reproducible. The fix is not effective on this origin yet. Check that the change is deployed here and on every instance.
- Not closed — inconclusive. A timeout, a firewall block or a lost session got in the way. Inconclusive results never close a finding.
GOOD TO KNOW
Read coverage, not just findings
Zero findings means the checks that ran found nothing — untested is not secure. Each scan lists the controls that were planned, which ran, and which could not run and why. A partial or inconclusive scan says so on the scan, on the finding and in the report.