1. Create and activate your account
Sign up with your email and a password of at least eight characters, including an uppercase letter and a special character. Open the confirmation link in your inbox to activate your account. Check your spam folder if the message is missing.
You can try the free public check before registering. Registration does not charge your card.
2. Choose a plan and verify your website
Choose Solo for up to five sites, Studio for ten or Agency for forty. Every paid plan includes the same tools; choose monthly or yearly billing and review the total in Stripe before paying.
Add a domain you own or are authorised to manage. Glarion gives you a verification token and two ways to publish it:
- Add a DNS TXT record at
_glarion-verify.yourclient.com. - Or host the token at
https://yourclient.com/.well-known/glarion-verify.txt.
Confirm the verification in your account. Proof lasts 30 days and must remain valid for full scans and scheduled checks.
3. Run a scan and review the findings
Start a full scan from your site page. Glarion checks for known vulnerability fingerprints and reads the TLS certificate. Findings keep their evidence and suggested next steps.
- Act
- A finding with a concrete next step.
- Review
- A result that needs human judgement or confirmation.
- Inventory
- Observed technical information. It is not proof that a security check passed.
Review the evidence before recommending work to a client. Automated findings do not replace a manual penetration test.
4. Share the report and set a schedule
Add your agency’s name and logo in Settings. Download the self-contained HTML report or use your browser’s print option to save it as a PDF.
Choose a weekly or monthly schedule for each verified site. Email notifications tell you when scan results change. Scan history stays available in your account.
What the checks cover
The free check reads public configuration. Paid scans test known patterns on verified domains. Neither can guarantee that a website is secure, and Glarion does not apply fixes or update plugins.
Technical scan limits
Full scans require a paid plan and current domain verification. Each site is limited to six full scans per rolling 24 hours. The scanner is capped at 20 requests per second, with bounded concurrency and execution time; intrusive, brute-force, fuzzing and denial-of-service template categories are excluded.
Destination checks reject non-public addresses. The external scanner resolves hostnames independently, so its network restrictions have documented limitations. Read the source and known limits for the technical details.
Read next
- Plans and annual savingsChoose the number of client sites you need.
- What the free check includesA quick first look, without an account.
- Writing a useful client updateExplain what matters and who should act.
- What a vulnerability scanner can checkAnd where its results need a human to confirm them.