Auto-checks and result emails
Have Lockpick check your site every week and email you what changed, like antivirus for your website.
An auto-check scans your site on a schedule and emails you the result. Your computer doesn't need to be on, and Lockpick still only looks at what anyone online can see.
Turn it on
- Open your site in Lockpick and choose the Auto-check tab.
- Choose Pulse or Deep, and how often. Deep needs proof you own the site.
- Confirm you own the site or are allowed to test it, and that you want Lockpick to keep checking it.
Checks run at about 9 in the morning in your time zone unless you pick another hour. How often you can check depends on your plan. The Free plan checks weekly with Pulse. The Deep plan checks weekly with Pulse or Deep.
Every auto-check uses a scan from your monthly allowance, the same as a scan you start. A weekly check uses about 4 scans a month, so checks on many sites can use more than your plan includes. When the month's scans run out, auto-checks wait, email you, and start again by themselves when your allowance resets. What uses a scan lists everything that counts.
Renew your agreement
Lockpick checks a site on your say-so for 90 days at a time. About 7 days before that ends, you get an email with a Renew for 90 days button, and the Auto-check tab shows the same. If you don't renew, the auto-check pauses until you turn it back on.
The email after each check
- Your grade and how it moved, for example "B, up from C".
- How many issues were fixed, how many are new and how many are still open.
- Up to three of the new issues, and the one to Fix this first, with a link to its prompt for your coding assistant.
- After a Deep auto-check, any Script changes to confirm, meaning new script providers or removed integrity hashes you haven't marked as expected.
- A note when the check couldn't see as much as usual.
- A link to open the full report.
When nothing changed, the email says so in its subject, so you can tell at a glance.
When an auto-check pauses
An auto-check pauses, and emails you, when it can't do its job. The Auto-check tab says why and what to do.
- The site couldn't be reached 3 times in a row. Check that it is up, then turn auto-check back on.
- The site blocked our checks, often a firewall, a bot check or a sign-in page. Let Lockpick through, then turn auto-check back on.
- The ownership record is gone. A Deep auto-check reads your proof, the DNS record, meta tag or file, before every check.
- Your agreement ended, or the limits for the checks changed and need your agreement again.
- You paused it. Nothing is checked until you turn it back on.
Choose which emails you get
Open Settings, then Notifications, to choose what Lockpick emails you from each workspace.
| What it is | |
|---|---|
| Scan results | What an auto-check found, after it runs |
| Auto-check problems | When an auto-check pauses and needs you |
| New vulnerabilities | When a newly published problem matches something your sites run |
| Deep scan finished | When a Deep scan you started finishes. Off until you switch it on |
| Product news | Now and then, what's new in Lockpick |
For scan results you can also choose, per site, After every check, Only when something changes or Never. Sites default to after every check.
Every email has a one-click Unsubscribe link for that kind of email, with a way to undo it. Sign-in and security emails always arrive.
Was this helpful?
Check again
Confirm a fix worked with a free re-read of your public records or a new scan, and see what changed since last time.
Scan every release or deploy from your CI
Run a Pulse or Deep scan of your site each time you release or deploy, from GitHub Actions, Vercel, GitLab, Bitbucket, CircleCI or a deploy script.