Exposure scans: profiles, tools and limits

An exposure scan runs a set of scanners against a domain and its watched hosts from a sandboxed container, and DomainGuard's own passive checks from the Worker. Every domain gets one scan when it is added; after that a scan runs when you ask, and on a schedule only if you say yes. The active scanners run only on a domain you have verified; see Verifying a domain for deep scans.

Where

Web: Security, Vulnerability scan (pick the domain and the profile); Scan options at the top of Security.
iOS: the domain's Vulnerabilities module, the Scan button beside the title. A "waiting on results" bar shows on the domain page while it runs, and the card moves on the server's count of scanners finished.
API/MCP: POST /api/vuln-scan/start (domain_id, scan_profile, optional target_hosts), GET /api/vuln-scan/results/:scanId, /latest/:domainId, /history/:domainId; tools start_vuln_scan, get_vuln_scan_results, get_vuln_scan_latest, get_vuln_scan_history.

Profiles

Profile	What runs	Needs clearance
Quick	DomainGuard's passive checks only: security headers, TLS and certificate, the technology fingerprint	No
Standard	Quick plus active web checks (Nuclei templates), exposed-file probes, subdomain discovery (Subfinder), dependency CVE lookups (Trivy), the WordPress plugin and theme checks and the port probe (Naabu)	Yes
Deep	Standard's web checks plus secret detection (Betterleaks) and asset-integrity tracking. It does not run the port probe; use Port-scan or Extreme for ports	Yes
Port-scan	The port probe alone, across every watched host, with the longest wall clock	Yes
Extreme	Everything, including the port scan; the slowest. Results can be emailed to you	Yes; paid

Every profile runs the same Nuclei template policy: high and critical templates only, with intrusive, fuzzing and denial-of-service templates excluded. The findings name the check that produced them in words: "Active web checks", "Server disclosure checks", "TLS & certificate checks", "Exposed files", "Secrets", "Open ports". Active tools cover the apex plus up to 40 in-scope hosts per run.

Manual allowances

Plan	Vulnerability scans
Free	1 every 7 days
Starter	5 a day
Pro	10 a day
Enterprise	50 a day

A refused scan returns the reset time. The scanner fleet also has a daily launch budget across all accounts; when it is exhausted a scan is queued and retried rather than failed, and the domain page says so.

The schedule (paid plans)

Scheduled exposure scans run the Standard profile on the account's scan frequency (daily, every 3 days or weekly; Enterprise can switch to hourly in Settings, Notifications, Scanning on the web dashboard, and is daily until it does) for domains that are active, inside the automated allowance, cleared, and have answered yes to "Keep scanning for exposure?" in the setup guide. Until you answer yes, nothing is scanned on a schedule, and you can stop it from the same place.

What you get back

Findings with severity, the host each was found on, the evidence, and a fix; hosts with open services; and the software the scan observed. A finished scan can send the Scan finished push if that switch is on.

Common questions

The scan says "Verify first" or domain_verification_required. Every profile but Quick probes the site, so it needs the domain verified: open the domain and tap Verify you own it (an email link, a DNS record or a file). Each domain is verified on its own. See Verifying a domain for deep scans.

Can a scan hurt my site? The templates are non-intrusive reads and the port probe is a connect test. Nothing exploits, writes or floods. Even so, the scanners only run on domains the account has shown it owns.