Uptime
HTTP/HTTPS checks every 1, 5, 15, 30 or 60 minutes (by plan) with expected status, keyword match and timeout. Two consecutive failures raise a down alert; recovery is announced.
Continuous monitoring
Know when something changes
Uptime checks run as often as every minute on higher plans; TLS is checked every 6 hours, DNS hourly, security headers daily and page content every 6 hours by default. Monitoring policies run on the same dedicated, egress-restricted workers as scans. Uptime results roll up into availability figures; TLS, DNS, security-header and page-content snapshots are diffed so you hear about material changes once, not on every check.
TasScan is invite-only right now. Request an invite and we will be in touch.
Policies
Five monitoring kinds in the current release
Uptime, TLS certificate, DNS record, security-header and defacement policies on any verified asset. Scheduled vulnerability scans and attack-surface discovery are managed from the same policies page.
TLS
Every 6 hours: chain trust, hostname match and expiry (alerts at 30/14/7/1 days), plus TLS 1.0/1.1 support and weak ciphers. A replaced certificate is reported with its new fingerprint.
DNS
Hourly: A, AAAA, CNAME, MX, NS, TXT and CAA records, SPF and DMARC. Changes raise an event with the exact diff; a removed or weakened SPF/DMARC record is flagged separately.
Security headers
Daily: HSTS, CSP, X-Content-Type-Options, X-Frame-Options / frame-ancestors, Referrer-Policy and Permissions-Policy. A header that goes missing or gets weaker after a deployment raises an alert.
Defacement & page changes
Every 6 hours by default (hourly to daily): your homepage and up to five key pages are fetched from our monitoring workers and compared with a baseline you accept. Alerts for defacement wording, hidden spam links, obfuscated scripts, redirects to a new host, blank pages, and new external scripts, frames or form targets, the pattern behind card skimmers. Timestamps, counters and nonces are ignored; you can exclude text and accept an expected change.
Defacement monitoring compares the HTML your server returns, without cookies and without running JavaScript: content that only appears in a visitor's browser, or only for logged-in users, is not seen. It is a change and tamper detector, not a malware scanner.
Alerts
Notifications you control
In-app and email
Per-trigger preferences for every member. Account security notifications (MFA disabled, password changed) always go by email.
Daily digest
An optional daily email at the hour you choose (in your organization's timezone): new findings by severity, monitoring events, completed scans and assets awaiting verification. Nothing is sent on a quiet day.
Score impact
Availability is reported next to the security score and does not change it. Findings raised by monitoring (an expiring certificate, a missing security header) count like any other open finding.
Signed webhooks, Slack, Microsoft Teams, PagerDuty, Jira and GitHub issue destinations are available on plans that include integrations. The platform delivers messages to the destination you configure; you confirm that it works with the Send test button, which sends a real test message to your own workspace or service. SMS alerts are available only on plans that include them and only when the platform operator connects an SMS provider; they are not configured by default. Browser-rendered monitoring is not available today: page-change monitoring reads the HTML your server returns and does not run JavaScript.
Let's talk
Start with a free external check.
Run the free security check now. An account lets you verify your domain and unlock the full report.
TasScan is invite-only right now. Request an invite and we will be in touch.