stackbrace.com · Vincent@codeandvin.com
Every client site. Who holds each layer. Checked every day.
When a client site goes down, the question is never “is it down?” It is who holds the hosting login, whose card the domain renews on, and who set up the DNS three developers ago. Stackbrace keeps that record for every site you look after, checks each one from outside every day, and when something breaks sends one alert that names the layer and the person who can fix it.
Built from a real outage, where detection was never the problem.
The record
- Registrar
- whose name the domain is in, where the login is kept, which card renews it
- DNS
- who can change the records, and what the nameservers are today
- Hosting
- the host, the panel login, who pays, where the server is
- Backups
- where they are, how often, when a restore was last tested
- Application
- the stack, the admin login, who built it, and every service the site loads
What a scan can see is filled in with its source and date. What it cannot see is a question for a person, and stays visible until answered.
The daily check
- Domain and DNS
- expiry and auto-renew, transfer lock, nameserver or registrar changes, forgotten subdomains
- SPF, DMARC and DKIM: whether anyone can send mail in the client's name
- Website
- up or down every five minutes, the certificate, HTTPS and the browser protections
- Software
- WordPress core, plugins and themes against known holes; libraries; the code on GitHub
Known holes from Wordfence Intelligence and CISA’s exploited list. Urgent findings are emailed the moment they are found; the rest wait for the weekly summary.
When it goes down
Three failed checks in a row, and one message goes to Slack, email or your own webhook. It names the layer most likely broken, where that login is kept and who holds it, and the first steps you wrote for exactly this. One message when it recovers. Nothing in between.
Down: harbourlaw.co.za
Layer: Hosting (the server answers, the site does not)
Login: xneelo konsoleH, in the agency vault as “Harbour Law”
Holder: Thandi (ops), paid by the client’s card
First steps: 1. Check konsoleH for a suspended account …
Example. The real one is built from the site’s own record.
Made for the agency
- Taking a site over
- a list of what to ask the previous developer for, built from what the scan found, with the email ready to send
- Handing one back
- a report for the meeting: the grade, the five layers, what to fix first, what is still missing
- The client's view
- a health card per site with your name and mark on it, through a private link, no logins in it
- Who leaves
- what if: pick a person or a provider and see every site that depends on them
What it will not do
- Never holds a login to a client site. The record says where a login is kept, never what it is.
- Reads only what a browser would: public pages, DNS, the certificate. Nothing is sent to a site.
- Scans a domain in full only once you have proved you control it.
- Two-factor login, every change logged, hosted in the EU, backups encrypted before they leave the server.