Changelog

• NewEach plan now has its room for what a workspace keeps (audit results, DMARC and TLS reports, questionnaires, files and logos): 25 MB on Free, 1 GB on Solo, 5 GB on Agency, 15 GB on Agency Plus. Usual use stays far below it. The Plan and billing page shows what the workspace holds; when the room is used up, nothing stored is touched and scheduled audits go on, but new files are refused with an explanation, until old data is deleted or the plan changes.
• ImprovedAPI: starting an audit on demand answers 507 (storage_quota or storage_full) when there is no room to keep its results.

• NewSecurity barometer of the UK councils (perimetry.cloud/research/uk-councils/): the 366 domains of the principal councils of England, Wales, Scotland and Northern Ireland, measured with the same passive checks as our other studies.
• NewSecurity barometer of the German local authorities (perimetry.cloud/research/german-local-authorities/): the Landkreise, kreisfreie Städte and Länder, and a comparison with the French local authorities, level by level (perimetry.cloud/research/france-germany-local-authorities/).
• ImprovedIn every study and in the peer comparison of the free check, a site that answers with an error page (often a filter that turns away data-centre networks) is no longer graded on its headers, which would be the filter’s; its certificate and redirect still are.

• NewUnder the local authorities study, an organisation can ask for its own private page (app.perimetry.cloud/study/request): its score, the checks of the study and where it stands among comparable organisations. The link is sent once, only to an address on the organisation’s own domain; nothing else follows, and neither the address nor the request is kept.

• ImprovedThe study of the French local authorities (perimetry.cloud/research/french-local-authorities/) now rests on a measurement of 14 November 2026, made again with the same checks and method as the edition of 8 November. 1,301 of the 1,372 graded bodies keep the same score; the change comes mostly from bodies that published a DMARC record in the meantime. The peer comparison of the free check uses the same figures.

• Newsecurity.txt checker (perimetry.cloud/tools/security-txt-checker/): whether a domain publishes the file that tells researchers how to report a vulnerability, where it is, its Contact and Expires fields, its expiry date, and the errors that make tools ignore it (RFC 9116).

• NewBIMI checker (perimetry.cloud/tools/bimi-checker/): the BIMI record, the logo checked against the SVG Tiny PS profile, the mark certificate (dates, purpose, domain, chain) and the DMARC policy mailboxes require before they show a logo. It says whether BIMI is ready, valid without a certificate, or published but unusable, and what to fix.

• NewMTA-STS and TLS-RPT checker (perimetry.cloud/tools/mta-sts-checker/): the _mta-sts record, the policy file fetched as a sending server would (no redirect followed, certificate checked), each of your MX hosts against the policy, and the TLS-RPT record. It says whether the policy is enforced, in testing, or published but unusable, and why.

• NewDNSSEC checker (perimetry.cloud/tools/dnssec-checker/): whether a zone is signed and validates, the DS record at the parent, the keys and their algorithms, and a broken chain told apart from a zone that is simply down.
• NewCAA record checker (perimetry.cloud/tools/caa-checker/): the records that apply to a domain or a subdomain and where they are published, which certificate authorities may issue ordinary and wildcard certificates, the iodef address and the errors that make an authority refuse. Both run in your browser: we see neither the domain nor the result.

• ImprovedThe page of a domain is now in tabs, each with its own address: Overview, Findings, E-mail, Web and certificates, Exposure, Proof, Settings. The overview keeps the score, what changed and the three things to do first. Links from alerts and e-mails open the right tab by themselves, and “All on one page” shows everything at once, as before.
• ImprovedThe menu is grouped by what you come to do: Watch, Fix (remediation, risks), Compliance (management, incidents, suppliers, questionnaires) and Agency. On the dashboard, the list of domains now comes before the trends.

• NewA page for the organisations that used the NCSC’s Mail Check and Web Check, retired on 31 March 2026 (perimetry.cloud/ncsc-mail-check-alternative/): what stopped and what continues, what Perimetry Cloud does for each thing they had and from which plan, what it is not, and where the data is kept. Facts about the NCSC’s services are read on its own pages, with sources.

• ImprovedOn the way to p=reject, the card now says who each sender with failing mail is and what to do. For about twenty-five sending services (Google Workspace, Microsoft 365, SendGrid, Mailchimp, Brevo, Amazon SES and others), it names the service and where to authenticate your domain in its settings; it tells forwarded mail, a server of yours and an unknown sender apart. The services are also named in the DMARC reports.
• NewBefore each step, the card says about how many of the messages seen would go to spam, or be refused, if the next policy applied today.

• ImprovedWhen our connection to one of your sites fails during an audit (a timeout, a passing network fault), its findings used to disappear, to be announced as resolved, then as new at the next audit. They are now kept as they were, marked as not read again, and the audit says which host it could not reach. After two audits in a row without an answer, the host is taken to be gone. Your score, your alerts and your tickets no longer move because of a failure on our side.
• ImprovedAudits now resolve the names of your sites through three independent public resolvers, and try a failed connection a second time before concluding anything.

• NewA comparison of our studies of the French and UK States: their domains side by side on the same checks, and what each State asks of its administrations and offers them (e-mail rules, the single GOV.UK site and the .gouv.fr extension, the tools offered, how to report a vulnerability), each point with its source.

• NewA new study of Perimetry Research measures the domains of the UK’s central government (GOV.UK, the .gov.uk domains of departments, agencies, public bodies and devolved governments, and the bodies’ own websites), with the checks of our study of the French State: grades by category, the domains without a site of their own shown apart, the honour roll, and a comparison with the French State. Serious issues were reported through the UK government’s vulnerability reporting service before publication. A PDF report and the figures in JSON come with it.

• NewA new study of Perimetry Research measures the 1,440 domains of the French State in the open lists of the DINUM and of the observatory of the State’s digital ecosystem: prefectures, ministries, académies, embassies and government sites, with the checks of our other studies. Grades by category and kind of site, the domains without a site of their own shown apart, the State’s own indicators, the honour roll, and a comparison with the communes, local authorities, higher education and .fr domains. Serious issues were reported to the CERT-FR of the ANSSI before publication. A PDF report and the figures in JSON come with it.

• NewA new study of Perimetry Research measures a random sample of 20,000 domains from the open data of the .fr registry, with the checks of our studies of public bodies: grades by age of the domain, mail provider and kind of site, and a comparison with the communes, local authorities and higher education. The registry does not say who holds most .fr domains, so no domain is named. A PDF report and the figures in JSON come with it.
• NewBusinesses and associations can now compare their domain with the .fr domains, in the free check and on each proven domain: all active .fr domains, or those of the same age, mail provider or kind of site.

• PricingOne-off report on the Free plan: for €49 excluding VAT, paid once, a proven domain gets the full audit of the Solo plan (lookalike domains included), the PDF report with each fix and the NIS2 mapping, and attestations, for 30 days. Subscribe to a paid plan within 30 days and what you paid is taken off your invoices.
• NewThe free check now compares a French public body with organisations of the same kind: choose communes, intercommunalities, départements, regions or universities under the result to see where the domain stands on the checks of Perimetry Research, check by check.
• NewA partner program for hosts and registrars (perimetry.cloud/hosting-partners/): they show the security score of their customers’ domains in their control panel, as a card or a JSON answer behind addresses signed with their own key, and earn the partner commission on the customers who subscribe.

• NewPortfolio audit, free on every plan for web and IT agencies: paste up to 30 of your clients’ domains and see them ranked by exposure, each with its score, its counts of critical and high findings and its three worst problems, from the public checks of the free check; download the ranking as CSV. 30 checks every 30 days. We check each agency by hand before opening it, usually within one working day.
• NewResale calculator for agencies: your number of client sites and your price per site give the Agency plan you need, your cost, your monthly and yearly margin and your break-even, with an offer and a client e-mail to copy.
• PricingFounding customers: the first 50 workspaces that subscribe to a paid plan keep 30% off their subscription for life, on every renewal and after a change of plan, for as long as the subscription stays active. The discount is applied on the payment page; the pricing page shows the places left.

• PricingThe verified active scan has its price: €49 a month per domain without VAT (€490 a year), from the Solo plan, with 1 domain included on Agency and 3 on Agency Plus. It tests the web applications of a proven domain with Nuclei and OWASP ZAP, signed in with a test account if you wish, on your signed authorization, within your window and at your rate, and marks each suspicion of the passive audit confirmed or not reproduced. Up to 20 hosts and 4 full scans a month per domain. Not sold yet: it opens workspace by workspace, and you can ask for early access now. A new page explains how it works, with a guide to passive and active scanning and a help article.

• NewExplain and fix with AI, on every finding: what it means, the concrete risk, the steps to fix it with the exact record, header or setting and the variants for common platforms (Cloudflare, OVHcloud, Microsoft 365, Google Workspace, Apache, nginx, WordPress), and how to check it is fixed. Written from that finding alone, in your language; e-mail addresses are removed and findings about leaked accounts are never sent. An answer is kept 30 days and shown again for free. 3 a month on Free, 50 on Solo, 300 on Agency, 1,000 on Agency Plus.

• NewPre-launch check, on the Agency plans: enter the host of a site you are about to hand over, even a staging host, prove that you manage it (a verified domain covers it, or a small file on the site), and the website checks run on that host only: certificate and TLS, security headers, cookies, CSP, scripts and outdated libraries, login forms, exposed files and admin pages, WordPress, trackers before consent, security.txt. You get a verdict (not ready, ready with fixes to plan, ready), a launch checklist and the fixes, grouped by what blocks the launch. 30 checks a month on Agency, 100 on Agency Plus.

• NewCorrection times, on the Remediation page: for each severity, a target (7 days for critical findings, 30 for high, 90 for medium, 180 for low, changed by owners and admins), how many findings were fixed in the last 12 months and how many within their target, the median time, and what is late, measured from the audits. A dated evidence log downloads as CSV, with its SHA-256: NIS2 asks you to handle vulnerabilities within defined times and to keep evidence of it. A finding put in the plan without a due date now gets the date of its target. From the Solo plan.

scanner 0.9.8

• NewThe domains your home page loads scripts from are now checked at every audit. A script from a domain known to have served malicious code (polyfill.io, sold in 2024 and turned against more than 100,000 sites, and its sister CDNs) or from a domain that is no longer registered, which anyone could buy to run code on your site, is reported as critical, with what to replace it with.

scanner 0.9.7

• NewThe status of your domain at the registry is now checked at every audit. A domain on hold (withdrawn from the DNS) or being deleted is reported as critical, with what to ask the registrar today. On generic extensions such as .com, .org or .io, a domain without a transfer lock is reported too: anyone who obtains its transfer code could move it, and your website and e-mail with it.

scanner 0.9.6

• NewVPN gateways and firewalls (Fortinet, Citrix NetScaler, Ivanti Connect Secure, Palo Alto Networks, SonicWall, Cisco, F5, Check Point, Sophos, Zyxel, Juniper, WatchGuard) and on-premises Exchange servers are now recognised on your addresses, from public scan data. They are the first target of attackers, and insurers ask about them: each comes with what to check (updates within days, multi-factor authentication, management interface off the Internet).
• NewThree more risky ports: LDAP (389) and LDAP over TLS (636), which expose a directory such as Active Directory, and PPTP (1723), a VPN whose encryption is broken. A host named like a remote access portal (vpn., remote., owa.…) is mentioned as a low-priority reminder.

• NewEvery hour, the vulnerabilities the last audit saw on your addresses are compared with the catalogs of vulnerabilities exploited by attackers, from CISA and now also from the European Union (ENISA, in the EUVD). One that becomes exploited between two audits, or that only the EU lists, shows at once on the domain page with its EUVD identifier, who says it is exploited, since when and on which address. From the Solo plan, your alert channels are told within the hour.

• NewA WordPress plugin: the score of the site's domain in the WordPress dashboard. Without an account, a free check in one click (the score and the three most serious problems). Connected to your workspace, on every plan including Free: every finding with its fix, and the proof that the domain is yours in one click from the site, without touching the DNS (changes to DNS records from Perimetry still need the TXT record). With your consent, once a day, the plugin sends what WordPress itself shows (versions, updates waiting, a few risky settings, how many administrators, never who), listed on the domain's page. For agencies: install it on every client site. In English, French and German. Coming soon to the WordPress plugin directory.

• NewManagement: one page a month, in plain words, for the people who run the company. Where security stands (under control, needs attention, needs a decision) and why; your domains, their average score and the problems open, fixed and new; the remediation plan and what is late, accepted risks, incidents, weak suppliers and availability; the three actions that would help most. Once the month is over, record that a member of management reviewed and approved it, with the decisions taken: the page is frozen, dated and sealed with a fingerprint, and downloads as a PDF. NIS2 asks management to approve the security measures and oversee them; this keeps a dated record. An aid, not legal advice. From the Solo plan.

• NewQuestionnaires received: when a client or an insurer sends you a security questionnaire, paste its questions (a column copied from a spreadsheet works) and each one gets a proposed answer. Your own past answers come first, from a library kept from one questionnaire to the next; then what Perimetry proves on your domains, dated: HTTPS and TLS, SPF and DMARC, security.txt, security headers, weekly external monitoring with your latest grade. A past answer that what we see today contradicts is flagged. Correct the answers, keep them, then copy the answers column back into the questionnaire or download a CSV file. Questions and answers are encrypted. From the Solo plan.

• NewIncidents: when a significant incident hits, open it with the moment you became aware of it and the deadlines of NIS2 are counted for you, in your time zone: early warning within 24 hours, notification within 72 hours, final report within a month of the notification, and the GDPR notification when personal data may be involved. Each report is drafted in the language of the authority (the ANSSI in France, the BSI in Germany, the NCSC in Ireland) with what you wrote and what we saw on your domains: changes from 14 days before, outages, serious findings. Read it, complete it and send it yourself, then note the reference you were given. What you write is encrypted. Help to prepare your reports, not legal advice. From the Solo plan.

scanner 0.9.5

• FixedSites served through Cloudflare could get a high "End-of-life software detected" finding: the public index tags some of Cloudflare’s shared addresses that way, and the tag describes the CDN, not your server. Like the open ports and vulnerabilities of those addresses, it is now left out. Fastly’s addresses are recognised too, and on an address only tagged as cloud infrastructure the finding is medium and says the address may be shared.

• NewSuppliers page: a new list of the services you use, read from the audits of your proved domains: your mailbox and DNS providers, the services allowed to send mail in your name, the platforms behind your subdomains, the tools you verified your domain with and the scripts of your home page. Follow any of them as a supplier in one click. Every plan.

• NewSecrets in public code: every week (every month on Free), public files on GitHub that mention your proved domains are read for passwords, keys and tokens: AWS, Stripe, GitHub, GitLab, Slack, SendGrid, OpenAI and Anthropic keys, private keys, passwords in addresses and in configuration next to your domain. Each one appears on the domain page with its type, its first characters, the file and the line; new serious ones go to your alert channels. Mark a secret as revoked, or as not yours. We never keep a secret itself. Every plan.

• NewA free NIS2 scope checker on the site, in English, French and German: your sector, size and country give your likely status (essential, important or not covered), the article of the directive that decides it, what it means, and where the law stands in France, Germany and Ireland, with each country’s official test. Runs in your browser; nothing is sent.

• NewImpersonation watch: paste your own urlscan.io key in Settings, and every day the public analyses of urlscan are searched for pages on other domains that load files from your proved domains or carry their name (copies of your login page, fake shops, phishing kits). The pages found appear on each domain page with urlscan’s verdict and a link to the report; new ones go to your alert channels. Dismiss a page, or mark a partner’s site as legitimate. Nothing is ever submitted to urlscan in your name. Every plan.

• SecurityWebhook alerts are now signed: each one carries a Perimetry-Signature header (time and HMAC-SHA256 of the body) made with the channel’s signing secret, shown under the channel on the Alerts page with a button to make a new one. Test messages are signed too. The help article on alerts shows how to check it.
• ImprovedAPI: a 429 audit_too_soon now says in Retry-After how many seconds to wait; SARIF is served as application/sarif+json; lang and min_severity ignore case, and an unknown min_severity answers 400 invalid_parameter instead of being ignored; a plan without the API answers with X-RateLimit-Limit: 0.

• NewA partner program for agencies on the Agency plans (perimetry.cloud/partners/): apply from the new Partner program page of your workspace and, once approved, earn 20% of what each client you bring pays, excluding VAT, for 12 months. Your page gives you a referral link with its QR code, a short pitch in English, French and German, a badge for your website, the clients you brought, your commissions and a statement to attach to your invoice.
• NewA public directory of partner agencies, where approved partners can list their country, languages and services for companies that want help near them.

• NewAn API reference (perimetry.cloud/docs/api/): authentication, hourly limits, every endpoint with its parameters, a curl example and a sample answer, every field of the answers and the error codes. In English, French and German, linked from the help centre and the footer.
• NewThe OpenAPI 3.1 specification of the API, public and without a key, at app.perimetry.cloud/api/v1/openapi.json: import it into Postman, Insomnia, a code generator or an automation tool. The reference page is built from it, and tests check it against the API itself.

• NewPerimetry Cloud compared with Detectify, Intruder, HostedScan and SecurityScorecard (perimetry.cloud/compare/): how each one looks at your security (passive reading or active testing), what it asks before scanning, how its price is built, and when the other service fits you better. Facts about the other services come from their official pages, with the sources and the date we read them.

• NewThree focused free checkers: the SPF record checker (perimetry.cloud/tools/spf-checker/) shows the DNS lookups each include costs against the limit of 10, duplicates, ptr and the all mechanism; the DMARC checker (/tools/dmarc-checker/) reads the policy, subdomain policy, pct, alignment and report addresses, and checks that report addresses on other domains have authorised your reports; the DKIM checker (/tools/dkim-checker/) reads the key of the selector you give, or of the common ones, with its type, size, revocation and syntax. Each page explains the error messages you meet in bounces and headers, and how to fix them.
• NewAn SPF record generator (/tools/spf-generator/) and a DMARC record generator (/tools/dmarc-generator/), each on its own page with the usual mistakes to avoid. The five-tab generator is still there for CAA, MTA-STS and security.txt.
• ImprovedThe SPF, DKIM and DMARC checker becomes the full e-mail authentication check, with the same new findings: duplicate SPF terms, invalid DMARC settings, unauthorised external report addresses, and DKIM records whose key, version or hash is not valid. The DNS map is now also a subdomain finder.

• ImprovedThe free DNS and surface map gets the subdomains from the certificate logs more often: it asks them two ways at once and keeps the first answer. When the logs are slow, the map comes first and the search goes on: reload a minute later to see the subdomains, at no extra count against your daily limit.

• NewA sixth free tool, the DNS and surface map (perimetry.cloud/tools/dns-map/): a domain’s records (A, AAAA, MX, NS, TXT with SPF, DMARC and the domain verifications named, SOA, CAA), DNSSEC, the subdomains found in the certificate transparency logs, the addresses they resolve to and the network, provider and country of each, on an interactive map with filters, tables, CSV and an SVG or PNG export. Public sources only: nothing connects to the hosts found.
• NewThe map is for cybersecurity research: tick the box that says so before mapping. Each network can map two different domains per 24 hours; a domain already mapped opens again without counting. For your own domains, Perimetry Cloud follows them without a limit once you prove you own them.

• NewPerimetry Cloud is now available in German: the application, the help centre, the guides, the PDF reports, the e-mails and alerts, the findings with their fixes, and the take-down letters. Choose Deutsch in Settings › Language, for yourself and for the reports and alerts of the workspace; status pages, attestations, pre-audits, supplier questionnaires and monthly client reports can be in German too.
• NewThe public site is in German at perimetry.cloud/de/, with its own legal notice (Impressum). Perimetry Research stays in English: its studies are about French organisations.

• NewThe Perimetry Cloud GitHub Action is published: add Enigmacker/perimetry-cloud-action@v1 to a workflow to fail a deployment when the score drops, falls below a minimum, or a new critical finding appears. The command for GitLab and other CI tools and the local MCP server follow on npm.

• NewFrom the Solo plan, send a supplier a security questionnaire from its page: about twenty short questions on governance, access and multi-factor authentication, backups, encryption, vulnerabilities, incidents (warning within 24 hours, notification within 72 hours), subcontractors, data location, the GDPR and the data processing agreement, certifications and continuity. Your contact answers by a personal link, in English or French, without an account; the page saves as they type, takes a file where it helps (a certificate, a DPA) and is locked once the answers are sent. Reminders go 7 days after sending and 2 days before the due date; you can cancel a questionnaire or send a new link.
• NewQuestions that can be checked from outside (valid HTTPS, HSTS, old TLS versions, security headers, security.txt, SPF and DMARC) are pre-filled with what Perimetry observes, for the supplier to confirm or correct. The answers page keeps “declared by the supplier” apart from “observed by Perimetry”, flags the contradictions, gives a simple answer score with how it is counted, and exports as PDF or CSV. You are alerted when the answers arrive.
• PricingSupplier questionnaires: 5 a month with Solo, 30 with Agency and 100 with Agency Plus. With the Agency plans, you can turn default questions off and add your own.

• PricingThe API is now included from the Solo plan (it was on the Agency plans only), with a limit of calls per hour: 300 on Solo, 1,200 on Agency, 3,600 on Agency Plus.
• NewAPI keys are read-only unless you tick “Can start audits” when you create them. Keys made before today keep the right to start audits. The latest calls of each key are listed in Settings and kept 90 days.
• NewNew API requests: one domain with its last audit and what to fix first, its findings with their fixes and DNS records ready to copy, the comparison with the previous audit, the history of audits, and the state of an audit started through the API. A domain can be named instead of using its id.
• NewAn MCP server at app.perimetry.cloud/api/mcp, so that Claude and other assistants can read your domains, scores, findings and fixes, and start an audit only when the key allows it.
• NewComing soon: a GitHub Action and a command for GitLab or any other CI, that fail a deployment when the score drops, falls below a minimum, or a new critical finding appears, and the MCP server to install on your computer. The help explains how to gate a deployment with the API until then.

• NewPasskeys: add one in Settings (Your account › Sign-in methods), then sign in with your device’s fingerprint, face or PIN, from the button on the sign-in page or from the passkey your browser suggests in the e-mail field. Since the device checks that it is you, no second-factor code is asked after a passkey.
• NewSign in with Google: link your Google account in Settings, or, with a Gmail address or a Google Workspace account on your own domain, create a new account with it. Google never opens an existing account just because the addresses match: its owner signs in as usual and links Google first. With the second factor on, its code is still asked after Google.
• SecurityAdding or removing a way to sign in now asks you to confirm it is you (your password, a passkey or Google, within the last 10 minutes), and the last way to sign in can never be removed. After a password reset, the passkeys and Google account that still open the account are listed in the confirmation e-mail and on the page, with a button to remove each.

• NewA new study in Perimetry Research covers the main French universities and higher education establishments, public and private, as the ministry of Higher Education lists them, with the checks of the communes study: grades by category and by sector, a comparison with the communes and the local authorities, and the establishments that get everything right. A PDF report and the figures in JSON come with it; it will be repeated every quarter from March 2027.
• NewOn each proven domain, the comparison with your peers now offers the universities and higher education establishments, by category.

• NewA new study in Perimetry Research covers every French intercommunality, the territorial public establishments of the Greater Paris, the départements and the regions, with the same ten checks as the communes: grades by category and by population, a comparison with the communes, the domains they share with their communes, and the authorities that get everything right. A PDF report and the figures in JSON come with it; it will be repeated every quarter from February 2027.
• NewOn each proven domain, the comparison with your peers now offers the intercommunalities (by category and by population), the départements and the regions.

• FixedWhen a site’s home page could not be read (a timeout, a connection cut), HSTS and the protective headers counted as failed in the communes study; they are now left out, as its method says. The November 2026 edition was recalculated (137 communes concerned, 31 of them gain a grade, the national average stays at 47); the methodology explains the change.
• FixedThe comparison with your peers applies the same rule: a home page the audit could not read no longer counts against HSTS and the headers.

• NewFrom the Solo plan, Slack and Microsoft Teams channels on the Alerts page: every alert (audits, downtime, certificates, DMARC steps, suppliers, look-alike takedowns) arrives as a rich message with the score, the findings by severity and buttons that open the report. Add Slack in one click with “Add to Slack”, or paste an incoming webhook; Teams uses a workflow address, since Microsoft retired the Office 365 connectors.
• NewFrom the Agency plan, PagerDuty: an alert opens for each critical finding (or high, if you choose) and when a site goes down, and is resolved by itself when an audit no longer finds it or counts it as an accepted risk, when the domain or the channel is removed, or when the site answers again.
• NewA weekly summary by e-mail for every member, in their language: for each workspace, what changed, new serious findings, what was fixed, what to do first, the deadlines of the coming week and availability. It comes on Monday at 6:00 in your time zone; choose another day, hour or time zone in Settings, or stop it in one click from the e-mail.
• ImprovedEvery channel has a “Test” button that sends a real message in its own format; Slack and Teams addresses pasted as plain webhooks get the rich messages too.

• NewOn each proven domain, choose a group of Perimetry Research, for now the French communes by size, and see where the domain stands: its grade on the study’s checks, the share of the group with a lower grade, and check by check (HTTPS, HSTS, DNSSEC, CAA, SPF, DMARC enforced…) the share of the group that passes, with the edition and the size of the group. Hospitals and clinics will follow when their study is published.
• NewThe comparison is also in the PDF report and in the monthly client report. It uses the published figures of the study only, never data of other customers, and it is not your Perimetry Cloud score: the study grades ten simple checks, the same way for every commune.

• NewFrom the Solo plan, each domain has a Look-alike domains page: the names one typo away from yours that the latest audit found, and the other domains with your brand in a valid certificate. “Prepare a takedown” opens a case for one of them.
• NewFor a case, we collect the evidence passively: DNS, the registrar and its abuse contact, the host of its addresses and its abuse contact, the certificates in the public logs, and one look at its home page (a sign-in or payment form, your brand, resources loaded from your site, how close it is to your site). Each element has its time and SHA-256 fingerprint; nothing is collected about the holder of the look-alike. Download it as PDF or JSON.
• NewAbuse letters ready to send to the registrar and the host, and a report for the official services (Google Safe Browsing, Microsoft, Netcraft, APWG, and PHAROS and Signal Spam for France), in English or French: copy them, or download them as .txt or as an .eml draft with the evidence attached. You send them yourself; we never contact anyone on your behalf.
• NewRecord each report you send. We check the look-alike every 6 hours while the case is open and alert your channels when it goes down or comes back.

• NewFrom the Solo plan, a public status page built on the uptime checks: choose the monitored domains it shows and give each a public name; it shows their state, 90 days of availability day by day, the average response time if you like, and an overall banner. One page on Solo, five on Agency, 25 on Agency Plus.
• NewOutages detected by the uptime checks appear on the page by themselves, without their technical cause; write incidents and maintenance with timestamped updates. Nothing else is shown: no monitored address, no IP address, no error message.
• NewVisitors subscribe by e-mail (confirmed by a link, unsubscribe in one click) or follow the Atom or RSS feed. The page is in English or French, in one of six colours, with your logo, not indexed by search engines unless you choose; on Agency Plus it does not mention Perimetry.

• NewFrom the Solo plan, a remediation plan: “Plan the fix” on a finding gives it to a member of the workspace with a due date; each finding of the plan has a status (to do, in progress, done) and a thread of comments where every change is noted too. A finding the latest audit no longer sees shows as fixed on its own; one accepted as a risk shows as such (neither fixed nor reminded) and is to do again if the acceptance ends.
• NewThe Remediation page lists the plan of the workspace or of one domain, with the filters To do, Overdue, Mine, Accepted as a risk and Fixed or done, and exports it as CSV or PDF (in the language of the workspace). The domain page has a card with its findings in the plan.
• NewThe person a finding is assigned to is told by e-mail, in their language, then reminded 3 days before the due date and once more if it passes while the finding is still there. Due dates are in the deadline calendar too.

• NewOn the page of a proved domain, two new charts over the history of your plan: the open findings of each audit by severity, and the mean time to fix by severity, week by week or month by month. A finding counts as fixed when it is gone and stays gone at the next audit, the same rule as the attestations.
• NewThe dashboard shows the same two charts for all your proved domains together, over the last 90 days.

• ImprovedA supplier beyond the number your plan includes (after moving to a smaller plan) is now marked “Not updated”, with the date of its last check and a link to the plans, instead of showing its last score as if it were current. A notice at the top of the Suppliers page counts them.
• FixedA supplier whose weekly check was postponed (beyond the plan, or too many checks that day) could in rare cases be postponed or checked twice by two runs at once. Each check is now recorded, and its alert sent, once.

• FixedIn French, the notes under the DNS records ready to copy (SPF, DMARC, CAA, MTA-STS, TLS reporting) are in French too.
• ImprovedThe card forms (subscribing, and replacing the card on the billing page) follow the dark theme.
• FixedOn a phone, the activity list of the settings no longer makes the page scroll sideways, and the plans of the billing page no longer squeeze on a small laptop screen.

scanner 0.9.4

• FixedA vulnerability exploited in the wild was always said to be used in ransomware campaigns, even when CISA does not know of such use. It is now said only when CISA reports it. Your next audit shows the corrected text.

• NewA “?” button at the top of the menu opens the help centre articles about the page you are on (a domain, its report, the risks, the settings…), in your language, each in a new tab, with the address to write to if you are still stuck.
• ImprovedThe ⌘K / Ctrl+K search also finds the articles of the help centre, by a word of their title or summary, with or without accents.

scanner 0.9.3

• NewTrackers before consent: the audience measurement, advertising and social trackers your home page loads before the visitor agrees, with their cookies, and whether a consent tool is there. Read without running scripts, so the finding says “at least”.
• NewThird-party scripts loaded without Subresource Integrity (SRI), or over plain HTTP. Scripts that change by nature (tag managers, payment and captcha scripts) are left out.
• NewDANE: the TLSA records of your mail servers are compared with the certificate each one presents, and a record that DNSSEC does not protect, or whose signature fails, is reported. Certificate warnings that DANE makes irrelevant are no longer raised, unless an MTA-STS policy makes some senders check the certificate anyway.
• NewBIMI, when you publish it: the record, the SVG Tiny PS logo, the mark certificate (VMC or CMC), and the DMARC enforcement BIMI needs before any logo is shown.
• Improvedsecurity.txt is checked against RFC 9116 (contact, expiry date, canonical address, content type), not only for its presence.
• NewWith the sensitive file probing turned on for a domain: administration logins reachable from the internet (WordPress, Joomla, Drupal, phpMyAdmin, Adminer, admin and cPanel subdomains). One request per address, nothing typed or submitted.
• NewInventory: the CDN or firewall in front of each site and HTTP/3, the third-party script origins of each home page (marked when SRI is missing) and the trackers it loads.

• ImprovedEvery list (domains, changes, inventory, risks, suppliers, prospects, alerts, invoices) has the same clear layout, and the main ones sort by a click on a column heading. Filters stay in the address, so a filtered view can be bookmarked or shared with your team.
• NewA new workspace gets a short getting-started list on the dashboard: add a domain, prove you own it, read the first audit, choose where alerts go, and invite a teammate on plans with a team. It follows what you have really done, and can be hidden.
• ImprovedAn empty list now says what will fill it and offers the next step; pages of the menu show their outline while they load; the score chart of a domain has axes, a shaded area, and shows each audit when you point at it or use the arrow keys.

• ImprovedThe website takes the look of the application, in light and dark themes, with a menu grouped into Product and Resources.
• NewThe home page shows screens of the application and what we promise: passive checks only, nothing to install, hosting in the European Union, cancel at any time, your data to export or delete.
• NewThe pricing page compares the plans side by side, feature by feature.

• PricingThe risk register (review and expiry dates, reminders, history and export) and the import of a list or a CSV of domains are included from the Solo plan, as the pricing page says. On Free, accepting a finding still takes it out of the score, without dates or reminders.

• FixedA DNS fix now goes only to the provider whose name servers answer for the domain. A zone kept at a registrar while the domain is served elsewhere is no longer changed by mistake.
• FixedWhen OVHcloud or Gandi stops answering half-way through a fix, the change can still be undone: a write that was not confirmed is looked up again instead of blocking the undo.
• SecurityThe OVHcloud keys we ask for are limited to reading and changing records: nothing that could reset or delete a whole zone. Existing keys keep working.
• SecurityThe address that receives TLS reports over HTTPS is limited per network, and a report sent to it can no longer take the place of the same report received by e-mail, signed by its sender.
• SecurityRemoving an owner or an administrator now changes the address of the deadline calendar, so that they stop receiving it.

• NewA help centre, in English and French, explains how to use Perimetry Cloud step by step: adding and proving a domain, reading a report and the score, the dashboard, fixing findings (records ready to copy, "Check if it is fixed", one-click DNS fixes, tickets, accepted risks), the timeline, the inventory, certificate and uptime monitoring, DMARC reports and steps, alerts, the deadline calendar, the API, compliance, attestations, suppliers, clients and prospects, team members, account security, plans and billing, and your data. It has a search box, and a link in the menu and the footer of the site.

• ImprovedThe domain page opens on a score gauge and the score of each family of checks (e-mail, web, DNS, exposure, brand and certificates), so you see at a glance where the points are lost.
• NewA score simulator: tick the findings you plan to fix, among those that bring back the most points, and see the score and grade you would get, before doing anything.
• ImprovedFindings are folded into one line each (severity, title, target): open the one you need. On a finding, J and K move to the next or previous one and O opens or closes it; a link to a finding opens it directly.

• NewFrom the Solo plan, each verified domain can receive TLS reports (TLS-RPT, RFC 8460). Turn them on from the DMARC card of the domain, publish the _smtp._tls record shown, and the servers that send you mail report every day how many of their connections to your mail servers were encrypted, and why the others failed (expired or mismatched certificate, no STARTTLS, MTA-STS or DANE problems), each failure explained in plain words, with the mail server concerned and who reported it.

• ImprovedEvery e-mail now comes in the Perimetry layout, light or dark with your mail app: audit alerts, certificate and uptime alerts, reminders of the risk register, account messages. The main action is a button, and the other links are short instead of long addresses.
• ImprovedThe audit alert shows the score with its grade, the open findings as named severity chips, what changed since the previous audit (new and fixed findings, new subdomains, look-alikes, certificates) and a button to the full report. Its text version no longer uses emoji.

• NewOne-click DNS fixes now work with zones at OVHcloud (keys created on the OVHcloud API, limited to the DNS zones) and Gandi LiveDNS (a personal access token), as well as Cloudflare. Connect one or several providers in Settings: each fix and each DMARC step goes to the account that holds the domain, shows the provider and the change before and after, and can be undone from the domain page.
• ImprovedThe button on a finding is now "Apply in your DNS", whatever the provider.

• NewThe first page of the app now opens on the posture of your proved domains: their average score as a gauge, how it moved in 30 days, and what it would be once the first three actions are done.
• New“Do these first” ranks the fixes by the points they bring back to a domain’s score, one line per kind of finding even when it is on several hosts. Next to it: the open findings by severity, the surface (hosts and IP addresses), how many domains are at DMARC p=reject, this week’s changes, and what is coming due (certificates, reviews of accepted risks).

• NewSettings now gives each workspace a private calendar address to subscribe to in Google Calendar, Outlook or Apple Calendar: the expiry of each certificate and domain registration, the DMARC steps (when a domain is ready for the next policy, or the earliest day it can be), and the review and expiry dates of accepted risks. One all-day event per deadline, with a link to the page concerned, in the language of the workspace. The address can be replaced (the old one stops working at once) or turned off.

• ImprovedThe menu of the app is now grouped (Watch, Manage, Agency, Account), with your workspace at the top; members of several workspaces switch from there.
• NewSearch from anywhere with ⌘K (Ctrl+K): any page, any of your domains, or an action such as adding a domain.
• NewChoose a light or dark theme, or follow your system, at the foot of the menu. The colours are new in both, with severity colours that stay readable.
• ImprovedOn a phone, the menu folds behind a Menu button.

• NewThe Inventory page lists what the latest audit of each proved domain saw: hosts (with their aliases, addresses, HTTPS and certificate), IP addresses with their open ports, technologies and known flaws, certificates by expiry date, and technologies (web server versions, WordPress, outdated JavaScript libraries). Filter, sort, export each table as CSV, and see a map from the domain to its hosts, their addresses and who hosts them (a CDN or a platform such as Netlify, Shopify or GitHub Pages, recognised without any new request).
• NewThe Changes page is a dated timeline of everything that changed on your domains: subdomains that appeared or went away, ports opened or closed, name servers, mail servers, DNSSEC, SPF and DMARC with their before and after, certificates issued (from the public logs, unusual ones flagged) or renewed, look-alike domains and cloud storage. Filter by family, domain and period, keep only what deserves a look, and export as CSV.
• FixedOn a phone, the list of domains no longer makes the whole page scroll sideways.

• NewAccepting a finding now adds it to a risk register: why it is accepted (false positive, compensating control, business need, fix planned), the measures that reduce the risk meanwhile, an owner, a review date and an optional expiry. The Risks page lists them with their state (active, review due, expired, closed) and how many current findings each one covers, and exports the register as CSV or PDF for a NIS2 or ISO 27001 assessor.
• NewThe owner of a risk (or, without one, the owners and admins) receives an e-mail 14 days before its review or expiry, then once a week, and when it expires. Editing a risk with new dates renews it; whoever saves approves it.
• ImprovedAn accepted risk is no longer deleted: it is closed, with the reason, and can be reopened. Each one keeps its history (accepted, edited, renewed, reminded, expired, closed, reopened). Acceptances made before keep their reason and expiry and start their history at their creation.
• SecurityThe certificate and headers checker can be protected by the same anti-robot check as the free scan.

• NewFive free tools, in English and French, with no account: an e-mail header analyzer (the route of a message, the delays, SPF, DKIM and DMARC, and the signs of a forged sender), a DMARC report reader (drop the XML, .gz or .zip reports and see every server that sends mail in your name), an SPF, DKIM and DMARC checker (with the SPF lookup count and the common DKIM selectors), generators for SPF, DMARC, CAA, MTA-STS with TLS-RPT and security.txt, and a certificate and security headers checker. The first four run entirely in your browser: nothing is sent to us.

• NewEach edition of the security barometer of French town halls can now be downloaded as a full report in English or French: executive summary, key findings, grades, every check, results by size and by département, the communes that get it right, website platforms, what lies behind the numbers, recommendations for town halls, and the methodology. Built from the same public figures as the page, so no commune with a weakness is ever named.

• NewThe Certificate Transparency logs of each proved domain are now read between audits: up to every hour on the Agency plans, every 6 hours on Solo, once a day on Free. You get an alert when a new certificate comes from an authority your CAA records do not allow, from an authority that never issued a certificate for the domain, or names a host never seen before. Ordinary renewals stay quiet, and the first reading is a reference, without alerts. The domain page lists the certificates seen, unusual ones first with the reason, and lets you mark one as expected.

• NewAttestations (from the Solo plan): on the page of a proved domain, issue a dated two-page PDF of what the monitoring saw over a period of 30 days to 12 months: since when and how often the domain is audited, the score and its trend, open findings and those fixed during the period with the median time to fix, e-mail protection, availability, domain expiry, accepted risks, and the NIS2 Article 21(2) measures an outside view can speak to. For an insurer, a client or an assessor, named on it if you wish, in English or French. Each one carries a QR code and an address where anyone checks that it is genuine, valid, expired or revoked, with the SHA-256 of its content. Valid 90 days; owners and admins can revoke it with a reason.
• NewProspects (Agency plans): run a pre-audit of a company you want to work with (the public checks of the free check, nothing that needs their consent; findings whose details could help an attacker are named by family only), get a PDF in your name with your logo, your pitch and your contact, and a link to share in English or French that tells you how many times it was opened (your own team does not count). A pipeline from new to won or lost; "won" makes the company a client with its domain waiting for its ownership proof. 30 pre-audits a month on Agency, 100 on Agency Plus.

• NewDMARC step by step to p=reject (from the Solo plan, with DMARC reports on): the domain page shows where you are (monitoring, quarantine, reject), what holds the next step back (two weeks under the current policy, enough reports, 98% passing, no failing sender, as seen in the reports of the large mailbox providers), and the record of the next step. Senders you do not know can be marked "Not mine": their mail is what DMARC stops. An alert goes to your channels once per step when the domain is ready. On the Agency plans, the step is applied in your Cloudflare account in one click, and logged with undo like the other DNS fixes.
• NewSuppliers: follow the domains of the companies you work with (3 on Free, 10 on Solo, 50 on Agency, 200 on Agency Plus). Each week they get the public checks of the free check, nothing more; you are alerted when a score drops by 10 points or a critical problem appears, and can send them an invitation to see the details once they prove the domain is theirs. For the NIS2 supply-chain requirement (article 21(2)(d)).
• New"Do these first" at the top of each domain page: the three findings that matter most, the quickest to fix first; and on the dashboard, the three most serious open findings across your domains, one per domain.

• NewClients › Report language: each client's monthly report, and the e-mails its recipients get, can be in English or French, whatever the language of your workspace. By default, the workspace's.

scanner 0.8.0

• NewForgotten hosts: subdomain discovery now also reads the hosts the Internet Archive kept, which never had a certificate of their own, and tests them like the others. A live one known only from the archive is listed.
• NewArchived backups: addresses of database dumps, backups and configuration files the Internet Archive kept are reported, with how to check them and have the archived copies removed.
• NewYour brand in other certificates, on every plan, for a distinctive brand name: other domains with your brand in a valid certificate, those with a sign-in word (login, secure, account) first. Domains you list as yours are left out.
• NewPublic npm packages whose links point to your domain, to check that none was published by mistake.
• NewSettings › Breached addresses: paste your own Have I Been Pwned key, and each audit counts the addresses of your verified domains found in known data breaches, with the breaches (numbers only, never the addresses or passwords). The key is stored encrypted.

• NewThe whole application is now available in French: the dashboard, the domain pages and their findings (title, explanation and fix), the reports, the compliance view, DMARC reports, alerts, tickets, settings, clients, billing and payment, the free check and the public score page. Settings › Language sets it for your account; signed out, the FR / EN switch on the sign-in pages, a link from the French site or your browser's language chooses it.

• NewWhen a workspace is set to French (Settings › Language), the PDF report of each audit, the monthly client reports and their e-mails, the alert webhooks (Slack, Discord, ntfy and JSON) and test alerts are in French, findings included: title, explanation and fix, plus the compliance mapping (NIS2, ISO 27001 and Cyber Essentials headings).

• NewSettings › Language: choose English or French for the e-mails of your account (sign-in, password, invitations, plan) and, for owners and admins, for the alert e-mails of the workspace: availability alerts and audit alerts, with the finding titles in French. An account created from the French site starts in French. The application, reports and webhook messages stay in English for now.

• NewA new Research section publishes studies of how well public bodies protect their websites and e-mail, measured with the same passive checks as Perimetry Cloud. The first one covers every French commune: grades, check by check results, figures by size and by département, website platforms, and the communes that get everything right. It will be repeated every quarter from January 2027.

• NewThe whole site is now available in French, at perimetry.cloud/fr/: pricing, how it works, every check, the free check, security, the six guides, the changelog and the legal pages (where the English version prevails). The FR / EN switch at the top of each page goes to the same page in the other language.
• NewThe application and the reports stay in English for now; their French version comes next.

• NewAgency plans: connect your Cloudflare account from Settings with a token limited to "Zone: Read" and "DNS: Edit". On SPF, DMARC, CAA, null MX and TLS reporting findings, "Apply with Cloudflare" shows the changes in the zone, before and after, and makes them once you confirm. "Check if it is fixed" starts right after.
• NewNothing is written if the records concerned changed since the audit, and a change is made in one atomic step: all of it or none of it. Every change is listed on the domain page with who made it and the value it replaced, and can be undone in one click. Your zones stay in your account.

• NewAgency plans: connect GitHub, Jira Cloud or Linear from the Alerts page. Each new finding at or above the severity you choose becomes a ticket, with what is wrong, the fix, the evidence and a link to the report. Never on a domain's first audit, never for accepted findings, ten per tracker and per audit at most. A finding that comes back after a fix gets a new ticket.
• NewWhen an audit no longer finds the problem, the ticket gets a comment (and is closed on GitHub). From the latest report, open a ticket for any other finding with one click; the finding then links to it.
• NewTrackers can be limited to one client, set to open tickets only on request, tested and paused. Tokens are checked with the tracker before they are saved, and stored encrypted.

• NewEvery verified domain is now checked to see whether its site answers: every 5 minutes on Free, every 3 minutes on Solo, every minute on Agency and Agency Plus. No answer within 10 seconds (or a name that does not resolve, a refused connection, a certificate error) or a server error, twice in a row: an alert by e-mail (and webhook from Solo), then another when the site is back, with how long it was down.
• NewA new Availability card on each domain page: whether the site is up, its uptime over 24 hours, 7 and 30 days, its response time hour by hour, and the latest incidents. A domain that is down is marked in the domain list.
• NewChoose the address to watch (a subdomain or a health page), or turn the checks off, per domain. Each alert channel can refuse downtime alerts.

• PricingPDF reports, DMARC reports and the compliance view (NIS2, Cyber Essentials, ISO 27001 requirement by requirement) are now included from the Solo plan. The Free plan keeps the full audit, the DNS records ready to copy, "Check if it is fixed", the public score and badge, and the requirements shown under each finding.

• NewAgency plans: a monthly PDF report for each client, with your logo and name, sent automatically on the 1st to the addresses you choose. For each domain: its score and how it moved, what was fixed and what appeared during the month, and what is left to do with the fix.
• NewA new Clients page: turn the report on, add the addresses (people outside your team confirm first, and every report has a link to stop it), download the report of any month, or send yourself a test.

• PricingWith DMARC reports, PDF reports and the NIS2, Cyber Essentials and ISO 27001 mapping, the paid plans now cost €19 (Solo), €79 (Agency) and €199 (Agency Plus) a month, or €190, €790 and €1,990 a year. The Free plan does not change.
• PricingSubscriptions taken before keep their price for as long as they run on the same plan and period.

• NewTurn on DMARC reports for a domain: we give you an address to add to your DMARC record (the record is ready to copy, with your current settings kept), then read the daily reports of Gmail, Outlook, Yahoo and the others for you.
• NewSee who sends mail in your name: each sender with its messages and how many passed DMARC, SPF and DKIM, the ones that fail highlighted, and when it is safe to move to a stricter policy.

• NewEach finding now shows the requirements it relates to: the NIS2 measures of Article 21(2), the five Cyber Essentials controls and the ISO/IEC 27001:2022 Annex A controls.
• NewA compliance view of every report lists each requirement of a framework with the findings that relate to it, and the PDF report has the same mapping. It helps prepare an assessment; an outside audit sees only part of each requirement, so it is never a certification.

• NewShow your score: turn on a public page for any verified domain, with its score, its grade and the date of the last audit (never the findings), and a badge to put on your site, with the HTML and Markdown code ready to copy. Off until you turn it on.
• NewThe badge follows your audits: it says "outdated" if they stop, shows how many risks you accepted (they are left out of the score), and turns grey within the hour once you turn the page off or the ownership record disappears.

• NewAdd up to 500 domains at once: paste a list or upload a CSV file, with an optional client name next to each domain (missing clients are created). The import says what was added and why anything was left out.
• NewDownload every TXT record still to publish as one CSV file, with the name and value for each domain. Imported domains are verified on their own once their record is found; nothing is scanned before that.

• NewFindings that a DNS record fixes (SPF, DMARC, CAA, MTA-STS, TLS reporting, a domain that sends no mail) now come with the exact record to publish, with its type, name and value and a Copy button. Each record is built for your domain: your mail provider recognised from your mail servers, the authorities that actually issue your certificates, what your current record already allows.
• NewThe same records are printed in the PDF report.

• NewDownload any report of a proved domain as a PDF: a cover with the site's logo, its name, its address, the date and the score, a summary, then every finding with its fix and evidence.
• NewThe site's own icon is used as its logo, or one you upload. On the Agency plans, your own logo and name appear on every report ("Prepared by").

• NewA new page explains how an audit runs, step by step: what it reads and never does, the public sources it uses and what they see, how the score is computed, how false alarms are avoided, and what a passive audit cannot see.

scanner 0.7.2

• NewThe expiry date of each domain is read from its registry. An expired domain, or one expiring within 60 days, becomes a finding (critical under a week, high under a month) and triggers your alerts; the domain page shows the date and the registrar.
• New"Check if it is fixed" on each finding of the latest audit re-runs only that check, in seconds, and says whether the problem is gone. The report and the score follow at the next audit.
• FixedSites behind Cloudflare were blamed for vulnerabilities that public databases list for Cloudflare's own servers (a false "actively exploited" finding). Those are now left out: they belong to the CDN, not to you.
• FixedThe free check field on the home page was unreadable in dark mode.
• ImprovedThe domains list has a search (domain or client), filters (changes to look at, high or critical findings, waiting for proof…) and a sort by lowest score, for large portfolios.
• ImprovedMore domains can be added per day on the larger plans (50 on Agency, 150 on Agency Plus).

• ImprovedAdding a domain no longer starts anything by itself. Its page offers two steps: a quick check of the public settings, when you choose to run it, then the ownership proof that unlocks the full audit, history and alerts.
• SecurityBefore the ownership proof, the quick check shows the public settings in full but names the other findings by family only (a subdomain that could be taken over, an exposed service…): their details come with the proof.
• ImprovedA new domain can be added once the previous one is proved (one at a time on Free and Solo, a few at a time on the agency plans), so unproved domains do not pile up.

• NewCheck any domain for free from the home page or the Free check page: score and the three most serious findings in about two minutes, without an account. Findings that would help an attacker are named by family only until the owner proves the domain is theirs.

• ImprovedAfter "Check the record now", the domain page shows the check as it runs and updates on its own: no reload needed.
• ImprovedWhen the TXT record is not recognised, the page shows the value we found instead, and what to change.
• ImprovedOnce the record is found, the page says so plainly and announces the first full audit, whose progress is shown. The quick audit run before the proof is labelled as a preview of public checks only.

• FixedAfter "Audit now", the progress bar now appears at once on the domain page; before, it only showed after reloading the page.

• NewYou can change the e-mail address of your account in Settings. The new address is used once you open the link we send to it; your current address is told about the request and about the change, and your other sessions are signed out.

• ImprovedSubscribing happens on a single page of the app: billing details, the price with VAT, then the card form, without leaving Perimetry Cloud.
• NewThe billing page now lets you replace your card (an unpaid invoice is settled with it straight away), update your billing name, address and VAT number, and download your invoices as PDF.
• ImprovedWhen your bank asks you to confirm the payment for a plan change, the confirmation opens over the billing page.

scanner 0.6.1

• NewA progress bar shows each step of an audit while it runs.
• FixedMail servers are no longer reported as unencrypted when the network between us and them strips the encryption offer: a reference server is checked first, and the finding is only raised when the problem is really on your side.
• FixedA Content-Security-Policy set in a <meta> tag of the page is now read together with the one in the HTTP headers, as browsers do.
• ImprovedLook-alike domains are rated by risk: a recently registered look-alike with a mail server is high; one registered years ago is low. Each one shows its registration date.
• ImprovedSites behind Cloudflare are no longer blamed for the ports its network answers on; hosts that bypass it, and could reveal your origin server, are listed instead.

• PricingYearly plans are €150 (Solo), €590 (Agency) and €1,490 (Agency Plus), two months free compared with monthly billing. The monthly equivalent shown is the exact amount.

• NewScheduled passive audits of your domains (e-mail authentication, DNS, certificates, subdomains, look-alike domains, websites, exposed services), with history, a score and alerts by e-mail, Slack, Discord, ntfy or webhook.
• NewOwnership proof before the first full audit, two-factor sign-in, client workspaces for agencies, an API and SARIF export.