Verified domains
Prove you control a hostname once, then ShellOrbit checks it for leaked keys, exposed files, and certificate problems.
These pages describe ShellOrbit as it runs today. Breaking changes to the HTTP API are announced before they ship, and existing request and response shapes stay supported.
Why verify
A verified domain is a hostname you have proved you control. Leak Alarm checks only verified domains, so nobody can point ShellOrbit at a site that is not theirs.
Every hostname counts on its own
example.com, app.example.com, and www.example.com are three domains. Each is verified with its own record, and each counts toward your plan:
| Plan | Verified domains |
|---|---|
| Starter | 10 |
| Pro | 30 |
| Business | Unlimited, within a fair use limit of 100 |
Verify a domain
- In the dashboard, open Domains and add the hostname.
- Publish the TXT record it shows you, on
_shellorbit-challenge.followed by your hostname. The value is a token bound to this one claim. - Choose Verify. Most DNS providers publish within minutes; some take an hour.
Finding the record shows control of the zone at the moment we looked, which is the same evidence a certificate authority accepts. Checks work on any hostname, the apex included.
Kept current
The record is checked again before every scan. If it is gone, for example because the domain changed hands, scanning stops and you are told why. Remove the record, or the domain in the dashboard, to stop on purpose.