Full website scans send attack payloads, so we need proof that you control the domain. Open Websites, add your domain, and use one of these two ways.
Option 1: DNS TXT record (recommended)
Create a TXT record named _heimdall-secscan.your-domain.com with the value shown on the Websites page (it starts with heimdall-secscan-verify=). A TXT record with the same value directly on the domain works too. DNS changes can take a few minutes to appear.
Option 2: verification file
Publish a text file at https://your-domain.com/.well-known/heimdall-secscan.txt that contains the value shown on the Websites page. The file must answer with HTTP 200 directly, without a redirect.
Then
Press Verify now. When the token is found, the domain shows verified and you can start full scans. We check ownership again before scans when the last check is older than a day, so keep the record or the file in place.
Notes
- Each host name is verified on its own:
www.example.comandshop.example.comare separate entries. - Removing the record or the file revokes the verification at the next check.
- If you scan a system on behalf of a customer, verify with their DNS or web server, or contact us with their written authorisation.