The Free plan

Free is not a trial. It is the whole inventory with every core check, run whenever you like, with no card and no expiry. An inventory you have to pay to complete is one nobody completes, and the domain nobody remembered is the one that lapses.

What is included

• Unlimited domains, each with the domain health scan, certificate read, email authentication checks, security checkup, and homepage SEO, accessibility and mobile scores, on demand (6 website scans a day). These are basic scans and run on any domain; deep scans need the domain verified, see Verifying a domain for deep scans.
• Three domains watched with the five-minute uptime probe and site-down push. Watching on Free is the probe only; the nightly re-scan is paid.
• One vulnerability scan every 7 days, on any domain; its active checks run on a domain you have verified (see Verifying a domain for deep scans).
• The lookalike check at 150 candidates, and reading the change history.
• Subdomain discovery up to 100 hosts.
• One breach-monitored address, re-checked daily or weekly if you choose (it starts on manual), with a push when a new breach lists it.
• KEV and CVE alerts against software your scans observed.
• Change events on scanned domains, with the "Did you make this change?" question, in the app. The change alert itself starts at Starter, with the nightly re-scan.
• Alerts in the Alerts feed on the web and in the app, pushed to the iOS app, for uptime, provider status, breach hits and KEV or CVE matches. And the setup guide.
• 100 credits, once, for a first Local SEO measurement after an upgrade, or for any credit-priced action.
• Questions to a person about plans and billing: Ask NHM or Email under Account, Support, open to everyone. (Ask NHM about a specific finding on your account is the Enterprise thread.)

What it leaves out

• The nightly re-scan. Beyond the uptime probe and the breach re-check, nothing runs unless you press scan.
• The alerts the nightly re-scan raises (change events, registration renewal, certificate expiry, DNS records, security score), and the DMARC and lookalike alerts.
• DMARC report intake and everything built on it.
• The SEO crawl, saved manual URL scans and AI suggestions.
• Lookalike watch alerts, scheduled exposure scans, the Local SEO suite, the API and MCP.

Ads

Free shows Google AdMob banners in the iOS app. Once ads have started, the app asks a signed-in Free account once, through Apple's App Tracking Transparency prompt, whether ads may use tracking; unless you allow it, every ad is non-personalised. Where your region's rules require it, Google's consent form comes first, and "Ad privacy options" under Account changes those choices. Any paid plan removes ads, and a paid account is never asked. The account-level answer (ad_free on GET /api/auth/me) is what the app reads.

Burst limits

A Free account may add at most 250 domains in any 30 days. It is a burst limit, not a cap on holding; every plan holds unlimited domains.

The Starter offer

When a Free account fills its third automatic slot, or opens a Starter-only module, the app offers Starter once (and not again for 30 days). The domain is kept and scanned on request either way.