1. Register an account and verify your email
Create under Register an account with your email address and password. Then verify your email using the message in your inbox. Afterwards, you can sign in at Sign in sign in.
2. Add websites
On the homepage My websites you enter up to ten public websites per email address and view their check results. You must be authorized to arrange monitoring. A verified email address is not proof of domain ownership. Your website credentials are not required.
3. Review public observations
The request records visible WordPress components, verifiable version evidence and availability. Websites are normally checked roughly daily at varying times; a suspected outage triggers a confirmation check. You can view evidence locations, assess detections and add your own version declaration. Your feedback remains visible alongside the automatic finding and does not change the CVE assessment.
4. Manage advisories and notifications
The CVE catalogue is a separate area with public advisories and original sources. In Manage you change your websites and notification channels. A webhook must answer the verification challenge before events can be sent. Webhook guide.
Before a CVE alert, we recheck the website's currently observable state. The optional weekly digest groups less severe and unconfirmed vulnerability notices. High and critical version-based matches, availability and TLS notices, and webhooks are not held until the summary.
5. Secure your account
Under Account & security you change your password and can set up an authenticator app as a second factor. Keep the recovery codes it generates confidential. If you forget your password, use Forgot password; email verification does not replace signing in with a password and, where enabled, a second factor.
6. Find a pentester or create a profile
In the Pentester directory you search by specialization, region and remote availability. You manage your own profile with your account. You control its public visibility. You can remove your profile independently of website monitoring or delete your account completely with its associated monitoring and profile data.
7. Software inventory and our own research notices
Under Manage you record other software products with a vendor, version and private label. Select the exact product from the catalogue so we can match relevant CVEs. You can also save unmapped products; this does not mean they have been checked. Update the version in your inventory after an update too.
If you choose, you can also enable reviewed DebugTeam research notices. We send targeted notifications by product and version; confidential submissions are reviewed before release.