Support & FAQ
Everything you need to know about using Guardr.
Getting Started
How do I scan a website?
Enter any domain on the homepage and click Scan. No account required. You'll see your security score, grade, and a breakdown of issues in under 2 seconds.
How do I add a site to my dashboard?
Sign in, go to your dashboard, and click "Add Site." Enter your domain — we'll run an initial scan immediately and begin monitoring uptime and security on your plan's schedule.
Do I need to install anything?
No. Guardr scans externally — no agents, no code changes, no server access needed. We only see what's publicly visible, the same as an attacker would.
Scanning & Monitoring
What does Guardr scan?
We check five categories: TLS/SSL configuration (HTTPS, HSTS, redirects), security headers (CSP, X-Frame-Options, Referrer-Policy, and more), DNS security (DNSSEC, CAA records), exposure risks (sensitive files and paths), and cookie security.
Is this a vulnerability scanner or penetration test?
No. Guardr monitors your public-facing configuration and uptime. We don't do penetration testing, code analysis, or access your servers. We catch the misconfigurations that make attacks easier.
How often does Guardr run a security scan?
Depends on your plan. Free: weekly. Starter: daily. Pro: every 6 hours. Agency: hourly. Each scan produces an updated security score and grade. You can also trigger manual scans anytime within your plan's rate limits.
How does uptime monitoring work?
We run health checks on your site at regular intervals (5 min for Free, 3 min for Starter, 1 min for Pro/Agency). If your site goes down, you'll receive an email alert. When it recovers, you'll get a recovery notification with the approximate downtime duration.
My site shows "Up (WAF)" — what does that mean?
Some sites use Web Application Firewalls that return HTTP 403, 429, or 503 to automated requests. We treat these as "up but blocked by WAF" rather than downtime, shown as an amber status in your dashboard.
Account & Data
How do I change my password?
Go to Dashboard → Settings → Password and click "Change." You'll need your current password and must meet the same complexity requirements as signup.
How do I export my data?
Go to Dashboard → Settings → Data & Privacy and click "Download." You'll receive a JSON file containing your profile, sites, scan results, uptime checks, and notification preferences.
How do I delete my account?
Go to Dashboard → Settings → Delete Account. You'll need to check an acknowledgment box, type "DELETE MY ACCOUNT," and enter your password. All data is permanently and immediately removed.
What data does Guardr store?
Your account info (name, email), the domains you add, scan results, uptime check records, alert history, and notification preferences. Passwords are hashed — we never store them in plain text.
Billing
Is the Free plan really free?
Yes. One site, weekly scans, 5-minute uptime checks, and 7-day history — free forever. No credit card required.
Can I cancel anytime?
Yes. No contracts, no commitments. Cancel with one click from your billing page. You keep access until the end of your current billing period.
Do you offer refunds?
We don't offer automatic refunds, but if you experience a technical issue that prevents you from using the service, contact support@guardr.io and we'll work with you to find a fair resolution.
Who processes payments?
LemonSqueezy is our Merchant of Record. They handle all payment processing, tax collection, and VAT globally. We never see your card details.
Troubleshooting
My scan shows a lower score than expected
Scan results reflect what's publicly visible at the time of scanning. Common reasons for lower scores include missing security headers, HSTS not being enabled, or cookies without Secure/HttpOnly flags. Each issue includes a description and guidance to help you fix it.
I'm not receiving alert emails
Check your spam/junk folder. Alert emails come from alerts@guardr.io. Make sure your notification preferences are enabled in Dashboard → Site Detail → Notifications.
My site is up but Guardr shows downtime
Some hosting providers or CDNs may block automated requests. If your site uses aggressive WAF rules, our uptime probes may be blocked. Check if the dashboard shows "Up (WAF)" status — this indicates your site is reachable but returning a block response to our checks.