"Needs an account" and "Ownership proof needed"

"Needs an account"

Where you see it: the four server-side rows of the guest check (the welcome screen's "Check a domain without an account") or the App Clip; a 401 from /api/checkup, /api/, /api/seo-check or the scoring endpoints.

Why: since 2026-08-26 every server-side scan needs a session. Each one runs real DNS lookups, TLS handshakes and page fetches, and the endpoints had been an anonymous scanner-for-hire.

Fix: create a free account (no card) and sign in. The two on-device checks (Content & SEO, Accessibility) run for anyone.

"Deep scans are off", "Verify first" or domain_verification_required

Where you see it: a deep scan of a domain you haven't verified: a full scan on the Scan tab, the deep security scan in "Run a check", a deep vulnerability scan, or the exposed-file probe in a checkup. Basic scans of the same domain still run, and so does everything in the background.

Why: deep scans test open ports, look for known vulnerabilities and probe for exposed files, the same traffic an attacker's scan sends. Since 2026-10-02 they run only on a domain you have verified you own, decided per domain.

Fix: open the domain and tap Verify you own it (web: the banner at the top of the domain, or Verify first). Pick one:

1. Email me a link. Choose an address at the domain you can read (we list the likely ones) and click the link within 24 hours. Free-mail addresses do not count.
2. Add a DNS record. We name your DNS host and link to its settings. Add a TXT record with Name _domainguard-scanverify and the value shown, using the Copy buttons.
3. Upload a file. Put the file at the address shown (the web has a Download button).

You don't need to come back and check: we look for the record or file every few minutes for a week, and Alerts tells you when the domain is verified. If you sign in with an email address at the domain, it already counts.

To deep-scan domains you can't verify (a client's, say), ask us to approve your account: Account, Scan access in the app, or POST /api/scan-access/request.

"Deep scans are off" on a domain when another is already verified

Expected: verifying one domain clears that domain (and its subdomains) only. Verify this one too, or ask us to approve the account.

scan_target_blocked / "protected target"

The domain is on the list of banks, government and education domains, and major platforms that the scanners will not touch without proof at that very domain. This applies even to an approved account. If you genuinely own it, prove it for that domain with the DNS, file or email-link method and the block lifts for that domain only.

A client's domain you cannot prove

File a request through the API or MCP (POST /api/scan-authorizations, tool request_scan_authorization) with the reason and a contact. An operator approves or declines; the domain's authorisation status shows the answer.

Related

• Verifying a domain for deep scans
• Check any domain for free