Getting started with SecureShield

1 Account & Login

After you register, SecureShield emails you a verification link via Resend. You'll need to click it before you can add a website — it's the one hard gate before anything else works.

The link is valid for 24 hours. If it expires, you can resend it from your account settings without creating a new account.

2 Website Setup

From your dashboard, choose Add Website and enter the domain you want SecureShield to watch — for example yourbusiness.com.

SecureShield runs scheduled checks for uptime, SSL, security headers, and exposed files. You do not need to change where your traffic is routed.

3 Verify domain ownership

Before SecureShield monitors a domain, it confirms you actually control it — this is a one-time DNS TXT record check, not an account permission.

Publish a TXT record at your domain's root with the exact value SecureShield shows you:

TXT   @   secureshield-verify=<your-token>

Once the record is live (DNS propagation is usually a few minutes, sometimes longer depending on your provider), click Verify on the website's page. SecureShield looks up the TXT record and, if it matches, flips the site to verified. This can only ever move a site from unverified to verified — it's a one-way check.

4 SSL & Uptime Monitoring

Verified websites are checked on their plan schedule (Free: 60 minutes, Starter: 30 minutes, Business: 15 minutes, Agency: 1 minute): is it up, and is the SSL certificate healthy (issued, not expiring, chained correctly).

If a site goes down or a certificate is about to lapse, that's reflected immediately on the website's dashboard card — you don't need to keep the tab open to notice.

5 Security Headers

Alongside uptime and SSL, the same scheduled check looks at whether the right response headers are present on your site.

The security score is out of 100, built from six response headers, each worth different points:

Scores map to a letter grade (90+ is an A, under 40 is an F). For anything missing, SecureShield detects what's serving your site — Vercel, Netlify, Render, or generic nginx/Apache — and generates a ready-to-paste config snippet for that specific platform, instead of a generic checklist you'd have to translate yourself.

6 Analytics

The Analytics tab rolls everything up: threats broken down by severity, threats by website, and a recent-activity feed.

This is the view worth checking weekly even if nothing's on fire — it's where an approaching SSL expiry or recurring monitoring findings tends to show up first.

7 Alerts (Slack / Discord)

Lives under Settings and is optional — nothing here is required to get value out of the dashboard itself.

Paste an incoming webhook URL from either platform into Settings and SecureShield posts a message to that channel the moment a threat is detected — no need to keep the dashboard open to notice something's wrong. There's a "Send test alert" button to confirm it's wired up correctly before you rely on it.

8 API & CI/CD

Also lives under Settings, and is optional — for teams who want SecureShield checks running as part of their deploy pipeline instead of only on a schedule.

Generate an API key from Settings and you can trigger a full security scan straight from your deploy pipeline:

curl -X POST https://www.secureshield.me/api/scan \
  -H "Authorization: Bearer YOUR_API_KEY"

This is meant to run right after a deploy, so a regression — a header that got dropped, a newly exposed file — fails the build instead of sitting unnoticed until the next scheduled scan.