What runs automatically, and what you press

Every plan holds unlimited domains and can scan any of them on demand; deep scans need the domain verified (which domains you can scan). What a plan buys is how many domains are watched without being asked, and the two modules Free leaves out (DMARC report intake and SEO crawls).

Watched domains by plan

"Watched" on a paid plan means the daily domain scan (DNS, registration, certificate and email records, plus the security checkup while security alerts are on), the uptime probe, change detection on each of those scans, and, where the domain has opted in, the scheduled exposure scan. The homepage SEO scan rides along with the domain's scheduled scan when it is due: every day on Pro and Enterprise and every week on Starter by default, and slower (weekly or monthly) or off per domain if you choose.

On Free, "watched" means the five-minute uptime probe and nothing else. The daily domain scan is paid only.

Cadence settings

On the web dashboard, Settings, Notifications, Scanning sets the frequency: daily (the default), every three days, weekly, or (Enterprise only) hourly. Hourly is never switched on for you, and each hourly pass covers at most 50 domains across all accounts. Enterprise's priority means its accounts are first in the order of each scheduled sweep; it does not move a scan you press ahead of anyone else's. Per domain, the web domain page's Daily scan & automatic checks card turns each automatic job (uptime, Website Watch, SEO and the rest) on or off for that domain alone, and Watch this domain automatically pauses it. In the app, a domain's Scan settings chooses Basic (the domain scan alone) or Standard (plus the security checkup, mail monitoring, SEO and the website review) and pauses it. A paused domain is not "run it yourself": Check now is refused until you resume it.

Over the allowance

A domain past the plan's automated allowance is not switched off and is not read-only. It stays in the account, scans whenever you ask, and accepts edits. The oldest domains on the account keep the automation. The web domain page marks it Over plan cap, and its schedule says it is scanned when you ask; in the app its header reads "on demand" instead of "watched daily".

What is automatic on every plan

• Breach re-checks for the one address Free may watch (five on Starter, ten on Pro, fifty on Enterprise). A breach is the one risk you cannot discover by looking, so even on Free you can set a watched address to be re-checked daily or weekly. A new address starts on manual until you pick one.
• KEV and CVE alerts. The vulnerability feeds are matched against every account's observed software regardless of plan. On Free the inventory only advances when you run a scan by hand: the alerting is automatic, the observing is not.
• Change detection on domains that are scanned, and the "Did you make this change?" question that follows. On Free the domain is only scanned when you press scan, and the alert for a change starts at Starter.

What paying adds

Manual scan allowances

Even on demand, scans are metered so one account cannot spend the day's scanner budget:

A full scan from the app's Scan tab is also limited to one per account per hour.

A refused scan returns the reset time, and the app shows the server's own message rather than a guess.