"Needs an account" and "Ownership proof needed"

"Needs an account"

Where you see it: the four server-side rows in the Check tab or the App Clip when signed out; a 401 from /api/checkup, /api/, /api/seo-check or the scoring endpoints.

Why: since 2026-08-26 every server-side scan needs a session. Each one runs real DNS lookups, TLS handshakes and page fetches, and the endpoints had been an anonymous scanner-for-hire.

Fix: create a free account (no card) and sign in. The two on-device checks (Content & SEO, Accessibility) run for anyone.

"Ownership proof needed" / scan_clearance_required

Where you see it: starting a Standard, Deep, Port-scan or Extreme exposure scan; the Software & services or Vulnerabilities screens; whole-domain breach monitoring; the custom probe.

Why: active scanners send requests the site owner did not invite, so they run only for an account that has proven it controls a domain. The rule is account-level: one proven domain clears every domain on the account for 90 days.

Fix, in order of ease:

1. Email link. Have a link sent to an address at the domain (postmaster@, admin@, your own mailbox there). Click it. The account is cleared. Free-mail addresses do not count.
2. DNS. Publish the TXT record at _domainguard-scanverify.<domain> with the token shown, then Verify.
3. File. Put the token in /.well-known/domainguard-verify-<token>.txt on the site, then Verify.

The setup guide's "Prove you own it" step carries the exact record with a Copy button.

"Ownership proof needed" on a domain when another is already proven

The app read per-domain proof until the 2026-09-12 build; the server has been account-level since 2026-09-10. Update the app, or pull to refresh.

scan_target_blocked / "protected target"

The domain is on the list of banks, government and education domains, and major platforms that the scanners will not touch on account-level clearance. If you genuinely own it, prove it for that domain with one of the three methods and the block lifts for that domain only.

A client's domain you cannot prove

File a request under Security, Scan clearance, Authorisation (POST /api/scan-authorizations) with the reason and a contact. An operator approves or declines; the domain's authorisation status shows the answer.

Related

• Scan clearance and ownership proof
• Check any domain for free