What is Stackbrace for? When a website breaks, the hard part is rarely noticing. It is knowing where it is hosted, who has the login, and who to phone. Stackbrace keeps those answers for every site you run, watches the sites, checks them every day for security problems, and when one breaks, sends one alert that says which part failed and who can fix it.
Can I try it without an account? Yes. Check a site looks at any domain from outside for about a minute and says, in general terms, what it found in four areas: the domain and its DNS, email, the website, and its software. Keeping a record of the site, watching it and being alerted needs an account. Sign up starts one on Free.
How do I add a site? Choose “Add site” and enter its domain, such as example.co.za. Stackbrace asks you to prove the domain is yours (see below), then looks at it from outside for about a minute, step by step on screen, and fills in what it can see. Then answer the questions it could not: who holds each login, who pays for each layer, and where the backups are.
What should I write for a login? Where it is kept and who has it, such as “Finance team, in the shared vault”. Never the password itself: Stackbrace has nowhere to store one. If nobody knows, choose “Don’t know”; it stays on the list as a question to chase.
Why does Stackbrace ask? A full scan shows exactly where a site is weak, which is as useful to someone attacking it as to its owner. So Stackbrace scans a site in full, and shows the detail, only for whoever can prove the site is theirs.
How? Stackbrace gives you one line of text to add to the domain’s DNS, as a TXT record named _stackbrace. The page says what to put in each box, finds your DNS provider for you, and can write an email with the instructions for whoever looks after your domain. It does not change how your website or email works. If you cannot reach the DNS, you can put the line in a file on the website instead.
It says the record was not found. A new record usually shows within a few minutes and sometimes takes up to an hour. Check the name is _stackbrace and the value is pasted whole, then press “Check now” again later.
Does one record cover every address? It covers the address you added and its www. version, so example.co.za and www.example.co.za are proved together. Another address under the domain, such as shop.example.co.za, is proved with a record of its own.
Can I remove the record afterwards? Leave it in place: Stackbrace looks for it every day. If it goes, the site is no longer scanned in full and its detail is hidden until the record is back. Uptime checks carry on regardless.
Is it safe for my site? Yes. Stackbrace only makes the requests a visitor or a search engine makes: it reads public pages and a short fixed list of public files. It never logs in, never sends a form, and never tries to guess hidden addresses. Past the homepage it follows the site’s robots.txt. Its requests name Stackbrace, so they are easy to recognise in your logs; the only ones that do not are the cloaking check’s, which ask as Google would, and they are made only for sites whose owner has proved control. What Stackbrace asks for, and from where.
What does it check? That the site is up and showing its real page, every 5 minutes on Business and once a day on Free. Then, once a day, four areas:
Domain, email and website are checked on any site, whatever it is built with. Where the information on known holes comes from is on the sources page.
Can Stackbrace check the site’s code? On Business, if the code is on GitHub. An owner connects GitHub under Settings and chooses which repositories Stackbrace may read, then each site is linked to its repository on its registry page, or straight after adding it. Every day Stackbrace reads only the repository’s lockfiles (npm, pnpm, Yarn and Composer), asks GitHub’s advisory database about the exact package versions, and reports packages with known holes and frameworks, such as an old Next.js, that no longer get security fixes. The connection is read-only, no other file is opened, and nothing has to be switched on in GitHub. Removing the app on GitHub, or the connection in Settings, stops it.
Can I scan a site now? Yes: “Scan now” on the site’s registry page, for owners and editors. It shows each step as it runs and what was new when it finishes. A domain is scanned in full at most once every ten minutes, whoever asks.
My site’s firewall turns Stackbrace away. What do I do? Cloudflare and similar services sometimes challenge Stackbrace’s checks. Uptime is still checked, through a browser, and a challenge is never counted as an outage, but parts of the scan cannot be made. The site’s registry page then shows what to add at the firewall, filled in for your site, with a message you can send to whoever manages it and a button to check again. Stackbrace never asks for a Cloudflare login or API token.
What does the Sites page show first? Every site at a glance, and what needs someone now. A site that is down comes first, with the layer that is most likely broken and where its login is kept. Then a card for each site, whose counts open what lies behind them. Below the cards, the most important thing to fix is set out on its own, with why it matters and what to do, then everything else, most serious first, and the questions nobody has answered yet. Each site also has a To do tab with its own list.
What is on a site’s page? Its registry: the five layers it rests on (registrar, DNS, hosting, backups and the application), each with what the scan found and what people added. Every entry says where it came from and when it was last checked. An answer a person gave is marked “Check again” after six months; “Still true” renews it.
What does “Registry incomplete” mean? That at least one of the main entries has no answer yet, or is marked “Don’t know”. In an outage, that is something nobody will be able to look up. It goes once every entry is answered.
What do Urgent, Should fix and Worth knowing mean? Urgent is a problem that can take a site down or means it may have been broken into, and only urgent findings send alerts (see Alertsfor which, on which plan). Should fix is a weakness worth fixing soon. Worth knowing is information. A finding closes by itself when a later scan no longer sees the problem. A change since the day before, such as a new script, stays until someone marks it as reviewed.
How is a site graded? Each of the four areas says its worst state in words. The grade, A to F, starts at 100 and loses points for every problem and every unanswered question. An urgent problem holds it at C at best, and an outage at D.
One person holds most of the logins. Will Stackbrace notice? Yes. When one person or login is named for two or more layers of a site, and losing them would leave a layer nobody else on record can get back into, the site’s page and “Across all sites” say so.
Can I print it for a meeting or a handover? Each site has a Report tab: the grade, who controls each layer, what to fix first, what the record is missing and recent downtime, with everything on record as an appendix. Print it, or save it as a PDF from the print dialogue.
When does Stackbrace tell me a site is down? After three checks in a row have failed, so a single hiccup does not wake anyone. Once a check fails, the site is checked every minute, so an outage is confirmed within a few minutes of the first failed check. You get one message when it goes down and one when it is back.
Who gets them? Everyone in the account, by email. On Business they also go to Slack, naming the part that broke, who holds its login and the first steps from your runbook. Connect Slack in Settings.
What counts as urgent? Signs that a site has been broken into, Google listing it as dangerous, a security hole rated Critical that can be used without logging in, a certificate that has expired or does not match the site, and a domain that is suspended, about to be deleted, or runs out within a week. These are emailed to everyone at once on every plan. On Business, every urgent finding also goes to Slack, and every other finding shows on the site as it is found. On Free the rest is kept for the monthly summary.
My domain renews itself. Why is its renewal urgent? Stackbrace cannot see whether auto-renew is on: only the registrar account shows that. Choose “It renews automatically” on the finding, or answer Auto-renew in the site’s registry. The renewal then stays on the list as worth knowing, and in its last week as something to check, since a renewal fails when the card on file has expired. It sends no alert, and becomes urgent again only if the date passes without a renewal.
What summaries are there? On every plan, an email on the 1st of each month with every site’s downtime, new and closed findings, what expires in the next 30 days and the questions still open. On Business, the same every Monday morning as well.
Can I test an alert? On Business, the runbook page sends a practice alert for any layer, marked as a drill, so you can see where it lands and whether the first steps make sense.
How would I know if Stackbrace itself stopped? Add a heartbeat address in Settings, from a service such as Healthchecks.io. Stackbrace calls it every minute while its checks are running, and that service tells you when the calls stop. The Sites page also says “Not checking” where it usually says “Live” when no check has been recorded for longer than your plan allows.
What is the difference? Free watches 1 site with 2 people, checked once a day. Business watches 5 sites with 3 people, checked every 5 minutes, with Slack and webhook alerts, the full history as it happens, a weekly summary, each site’s code on GitHub checked for known holes, fire drills and “what if”. The registry and urgent alerts are part of every plan. See the pricing.
How do I pay for Business? Choose Business on the pricing page. Without an account, you sign up first: once you have confirmed your email address, paying is the first thing you see. With an account, an owner pays under Settings, then Plan. Payment is taken by Dodo Payments on its own page, in your currency with any tax added; Stackbrace never sees your card.
How do I change the card, get an invoice or cancel? Under Settings, then Plan, choose “Manage billing or cancel”, which opens Dodo Payments’ billing page. A cancelled plan stays until the end of the period already paid for. A first payment can be refunded in full within 7 days: see refunds.
What if I move to a smaller plan, or a payment fails? Nothing is deleted and no site stops being watched. Sites are checked on the Free plan’s schedule, and the history appears again when you move back. A failed payment keeps your plan for seven days while it is tried again.
What is the written audit? A written report on one site, from its scans and registry, with the fixes in the order to make them. It costs $149 once, on any plan, and is ordered under Settings, then Plan, for a site whose domain you have proved. The report follows by email.
Do I need it? It is not required, but we advise it. Stackbrace records where every login for your websites is kept, so someone with your password would learn a great deal; with two-factor login they would also need your phone. Turn it on under Settings, then Your login: it takes two minutes and any authenticator app (Google Authenticator, Microsoft Authenticator, 1Password, Bitwarden). Until you do, your dashboard reminds you. Once on, it cannot be switched off.
I have a new phone. Under Settings, then Your login, choose “Move to a new phone”. You need your password and a code from the old phone, or one of your recovery codes.
I lost my phone. Log in with one of the recovery codes you saved when you set it up, then move to a new phone and make new codes. If you have lost those too, write to Vincent@codeandvin.com. We confirm it is you by some other route than your email before resetting it.
Who can do what? Owners can do everything, including inviting and removing people, settings and paying. Editors can change the registry, sites and runbooks. Viewers can read everything and change nothing. Invite people on the Team page.
Why two owners? So the account is never left with nobody able to manage it. Stackbrace reminds you until there are two.
Someone has left. What now? Remove them on the Team page. Before you do, Stackbrace lists every login the registry says they hold, so you can move those too. If every owner has gone, someone with an email address at your organisation’s domain can recover the account by adding a DNS record.
How do I leave an account? Under Team, then You, choose to leave it. The only owner cannot leave while others are in the account: make someone else an owner first.
Can I be in more than one account? Yes, and you switch between them from the menu at the top right. “New account” in the same menu starts another of your own. A second Free account needs an invitation code: write to Vincent@codeandvin.com.
Can I take my data with me? Yes. Download what Stackbrace holds about you from the Team page, and owners can download everything in an account from Settings.
How do I delete my account? An owner can delete it in Settings, which removes everything in it. You can delete your own login from the Team page. See the privacy policy for what is kept and for how long.
Something else? Write to Vincent@codeandvin.com.