Stackbrace keeps the record of who controls each part of your clients’ websites, checks them from outside every day, and when one goes down sends one message naming the part that failed and who can fix it.
Its domain, email, website and software, as anyone can see them. About a minute, and no account.
example.co.zaDown
Registry incomplete1 answer missing
| Layer | Seen from outside | Who holds it |
|---|---|---|
| Registrar | Registered until 4 March 2027, set to renew itself From the registry's records, checked 06:00 | Naledi in finance holds the login. |
| DNS | Cloudflare From the nameservers, checked 06:00 | Thandi at the agency can change it. |
| Hosting | Down since 14:02. The server refused the connection. 3 failed checks a minute apart, from Helsinki | The panel login is in the agency's shared vault, held by Thandi. |
| Backups | No scan can see a backup. Asked of Sipho three days ago | Don’t know. |
| Application | WordPress, 14 plugins, all current From the homepage, checked 06:00 | Built by Brightside Digital. The admin login is with the marketing lead. |
Sent at 14:05 to #site-alerts and by emailone message now, one when it is back
DOWN: example.co.za since 14:02. 3 failed checks.
Likely layer: Hosting
Login held by Thandi at the agency, in the shared vault
First steps, from the runbook
1. Open the host’s control panel and see whether the server is running.
2. If it is not, restart it. If it will not start, phone the host.
Stackbrace was built after a company’s main site went down with malware. Everyone knew within minutes. What nobody knew was where it was hosted, who had the login, or whether there was a backup.
Here is the same outage twice, with and without those answers to hand.
Without a record
Still down at 16:17
With Stackbrace
Back at 14:13
The site stops answering.
A customer emails to say the site is down.
Who built it? The developer left last year.
Someone finds an old invoice from a hosting company.
The host will only speak to the account holder. Nobody knows who that is.
Still down.
The site stops answering.
One alert: the hosting server refused the connection, and Thandi at the agency holds its login.
Thandi opens the host’s control panel, as the runbook says. The server has stopped.
She restarts it.
Stackbrace sees the site answer twice and says it is back.
An example. The people and times are made up; what Stackbrace does in it is what it does.
Stackbrace scans every site again each day, from outside, reading only what any visitor can, and rates it in four areas. Three apply to any site, whatever it is built with; on WordPress the software is checked in depth as well.
The most urgent, such as a site Google lists as dangerous or a critical hole that needs no login, are emailed straight away on every plan. On Business, anything urgent also goes to Slack as soon as it is found.
example.co.za4 open findings, scanned 06:00
UrgentSoftware
A plugin on the site has a known security hole
Contact Forms 5.2.1: rated critical, needs no login, and being used in attacks. Update to 5.2.4.
Should fixEmail
Email that pretends to come from the domain is not refused
No DMARC record, so receivers are not told to refuse email that pretends to be from example.co.za.
Should fixSoftware
A script library the site loads has known security holes
jQuery 1.12.4 on every page. Update to 3.5.0 or later.
Worth knowingWebsite
Browsers are not told to always use the secure version
No Strict-Transport-Security header on the homepage.
Any site
WordPress
Code on GitHub, with Business
Careful malware checks that a visitor claiming to be Google really is, so the check for spam shown to search engines finds some hacks of that kind, not all.
Vulnerability data from Wordfence Intelligence, CISA’s Known Exploited Vulnerabilities catalogue, endoflife.date and Retire.js. Sources and licences
Each of the five layers can take a site down, and each is usually looked after by someone different. A scan fills in what it can see from outside. You add what only a person knows.
Add one line of text to the domain’s DNS. Stackbrace finds the DNS provider, says what goes in each box, and writes the request for whoever looks after it. Only someone who has proved a site is theirs sees the detail of its scan.
About a minute from outside, a line at a time: registrar, DNS, hosting, certificate, email set-up, what the site is built with, and what it gives away. The record fills in as it goes.
Who holds each login, who pays for each layer, where the backups are, and whether the domain renews itself. Each answer carries your name and the date.
Stackbrace checks that the site is up and showing its real page, every five minutes on Business and once a day on Free. Every day it scans again for new holes and changes, and warns before anything lapses.
You are phoned first when a client’s site breaks, whoever built it. Stackbrace gives you the record to answer with, and the same record for every site, however many developers it has been through.
Coming soonThe Agency plan
A tool that knows this much about your sites has to be careful what it holds, what it shows and who it lets in.
Priced by the number of sites. The record is part of every plan, and urgent problems, such as a site that looks hacked or a domain about to lapse, are emailed straight away on every plan.
Prices in US dollars, excluding any taxes, which are calculated at checkout.
Samples of what lands in your inbox and what your clients see.
Checking a site needs no account. Keeping a record and being alerted needs one. The Free plan costs nothing and covers 1 site for up to 2 people. Move to Business from Settings when you need more.
$0for as long as you like
1 site, 2 people. Checked once a day.
$19a month, or $190 a year
5 sites, 3 people. Checked every 5 minutes.
$149per site
A report on one site, written from its scans and registry. For taking over a site, handing one on, or the week after an incident.
On any plan, Free included, and it changes nothing about the plan. Because the report names specifics, it is ordered from Settings for a site whose domain you have proved you control.
from $79a month
For agencies and teams looking after 25 sites or more. Adds the Stackbrace WordPress plugin, client health cards you can share, access for clients to their own sites, and unlimited team members.
stackbrace.com, checked 26 Oct, 08:55
Nothing stood out from outside. The same check anyone can run on any domain, run on this one every day. Run it on yours