Changelog
What changed, newest first. Dates are the day it went live.
Clients, and your mark on the health card
A Clients page groups sites by whose they are. A client member you invite can be given a client instead of a list of sites, and then sees every site of that client, now and later. Upload your agency's mark in Settings and every health card and the client page carry it beside your name.
Webhook alerts
On Business, every alert can also be posted to an address of yours as signed JSON (Standard Webhooks): a site down or back, an urgent finding, a fire drill. Set it in Settings; the signing secret is shown once. Works with Zapier, Make, n8n, Microsoft Teams workflows, PagerDuty or your own code.
A page for every outage
Each incident has its own page: what the checker saw layer by layer, who holds the login for the likely layer, the first steps from the runbook, a log to write in while you work, what fixed it, and what the record should say now, which can be saved straight into the registry. Down alerts open it.
Who pays
The registry asks, for the domain, DNS, hosting and backups, who pays and how. A domain or certificate about to run out is usually a lapsed card on someone's account, so the expiry alerts now name the payer, or say that nobody is recorded.
Hijack alerts
A change of nameservers or registrar since the day before is now urgent and alerted at once on every plan, with what to do if nobody on your side made it. A change of mail provider, or a site served from entirely new addresses, is reported as something to confirm. All four close with one click once confirmed.
Status, security and the counting of visits
A status page built from the checker’s own records, a security page with a published address for reporting vulnerabilities, and visits to these public pages are now counted by Stackbrace itself, without a cookie or any outside script. The front page shows Stackbrace’s own site graded by its own daily check.
Outpost becomes Stackbrace
A new name, a new mark and a new address: the public site at stackbrace.com and the app at app.stackbrace.com. Links to the old address carry on working. The proof-of-control record is now
_stackbrace; sites verified under the old name are asked to publish the new one. The front page was rewritten for agencies.Two-factor login is advised, not required
A password alone logs in again. Settings advises turning two-factor on and sets it up in place; once on, it still cannot be switched off by anyone but you. Signing up is shorter: confirming your address logs you in.
GitHub on Business
The read-only GitHub connection, which reads each site's code daily for packages with known holes and frameworks past their security fixes, comes with Business rather than waiting for Agency. The written audit has its own card beside the plans.
A dashboard that leads with what needs someone now
Sites that are down come first, with the likely layer, where its login is kept and the first steps. Every count on a site card opens the list behind it. Each site has a To do tab. Auto-renew is a registry answer: a domain that renews itself is no longer an urgent problem until the last week. The GitHub connection is built: connect, link a repository to a site, and have its code read every day.
Checks for any site, health by area, and a report for handovers
Email (SPF, DKIM, DMARC), domain (on hold, no transfer lock, a single nameserver, www missing) and website (HTTPS, mixed content, security headers) checks for every site, whatever it is built with. Every site is rated in four areas. The site report was redesigned for a meeting or a handover. Scans show their progress. Stackbrace follows robots.txt, publishes what it asks for, and helps a site owner let it through a firewall.
Free is open
Anyone can sign up for Free without an invitation. The public check is on for everyone. Check results are kept for 90 days; outages are kept for good.
Add to Slack
Each account connects its own Slack by choosing a channel, through Stackbrace's own Slack app. A cancelled subscription keeps its plan until the end of the period already paid for.
Known security holes, firewalls, and the outside lists
WordPress core, plugins and themes are checked against Wordfence Intelligence's list of known holes, and holes being used in attacks (from CISA's catalogue) are urgent whatever their rating. PHP, nginx and Apache versions past their security fixes, plugins withdrawn from WordPress.org, and script libraries with known holes are reported. A firewall challenging Stackbrace is never taken for an outage. Payments through Dodo are open.
First deployment
Outpost, as it was then called, went live for its first sites: the registry of who holds each layer, uptime checks, daily scans, alerts by Slack and email, teams, plans, summaries and the client health card.