Getting started with SecureShield

1 Account & Login

After you register, SecureShield emails you a verification link via Resend. You'll need to click it before you can add a website — it's the one hard gate before anything else works.

The link is valid for 24 hours. If it expires, you can resend it from your account settings without creating a new account.

2 Website Setup

From your dashboard, choose Add Website and enter the domain you want SecureShield to watch — for example yourbusiness.com.

Origin server (optional, but worth filling in)

There's a second field for your origin server — the hostname or IP where your site actually runs (a VPS, Render, Vercel, shared hosting, anywhere). This is not the same as the domain above.

• Leave it blank and SecureShield only runs scheduled outside-in scans — uptime, SSL, and security headers.
• Fill it in and, once domain verification succeeds and you point DNS at us, SecureShield can also sit in front of live traffic as a reverse proxy — see step 4.

3 Verify domain ownership

Before SecureShield actively protects a domain, it confirms you actually control it — this is a one-time DNS TXT record check, not an account permission.

Publish a TXT record at your domain's root with the exact value SecureShield shows you:

TXT   @   secureshield-verify=<your-token>

Once the record is live (DNS propagation is usually a few minutes, sometimes longer depending on your provider), click Verify on the website's page. SecureShield looks up the TXT record and, if it matches, flips the site to verified. This can only ever move a site from unverified to verified — it's a one-way check.

4 WAF & Firewall

This step is optional and available on the Business and Agency plans. Skip it and SecureShield keeps running scheduled scans from the outside. Turn it on and your traffic is filtered at Cloudflare's edge before it reaches your server.

Protection runs on Cloudflare's WAF, which blocks common attacks such as SQL injection, cross-site scripting and path traversal before they reach your server. Clean requests are forwarded to your origin as normal.

5 SSL & Uptime Monitoring

Every verified website gets a scheduled check every 15 minutes: is it up, and is the SSL certificate healthy (issued, not expiring, chained correctly).

If a site goes down or a certificate is about to lapse, that's reflected immediately on the website's dashboard card — you don't need to keep the tab open to notice.

6 Security Headers

Alongside uptime and SSL, the same scheduled check looks at whether the right response headers are present on your site.

The security score is out of 100, built from six response headers, each worth different points:

Scores map to a letter grade (90+ is an A, under 40 is an F). For anything missing, SecureShield detects what's serving your site — Vercel, Netlify, Render, or generic nginx/Apache — and generates a ready-to-paste config snippet for that specific platform, instead of a generic checklist you'd have to translate yourself.

7 Analytics

The Analytics tab rolls everything up: traffic and request volume (only populated once you've enabled proxying in step 4), threats broken down by severity, threats by website, and a recent-activity feed.

This is the view worth checking weekly even if nothing's on fire — it's where a slow SSL expiry or a creeping pattern of blocked requests tends to show up first.

8 Alerts (Slack / Discord)

Lives under Settings and is optional — nothing here is required to get value out of the dashboard itself.

Paste an incoming webhook URL from either platform into Settings and SecureShield posts a message to that channel the moment a threat is detected — no need to keep the dashboard open to notice something's wrong. There's a "Send test alert" button to confirm it's wired up correctly before you rely on it.

9 API & CI/CD

Also lives under Settings, and is optional — for teams who want SecureShield checks running as part of their deploy pipeline instead of only on a schedule.

Generate an API key from Settings and you can trigger a full security scan straight from your deploy pipeline:

curl -X POST https://www.secureshield.me/api/scan \
  -H "Authorization: Bearer YOUR_API_KEY"

This is meant to run right after a deploy, so a regression — a header that got dropped, a newly exposed file — fails the build instead of sitting unnoticed until the next scheduled scan.