Security at WebUpCheck

What is in place today, and what is not yet.

WebUpCheck Protect sits in front of APIs our customers depend on, so we describe its controls precisely and list the gaps plainly. This page covers the Protect service at app.webupcheck.com and the free diagnostic tools at webupcheck.com. It deliberately leaves out internal infrastructure details.

Last reviewed 25 October 2026.

Accounts and sign-in

• Passkey sign-in. Accounts use WebAuthn passkeys with user verification. There are no passwords to reuse, phish or leak.
• One-time recovery codes. Codes are stored only as hashes. Using one consumes it and signs out every existing session.
• Optional email recovery. After verifying an address, you may enable one-time recovery links. They expire after 15 minutes, revoke existing sessions, API keys and connected apps, and grant only enough access to save a replacement passkey, which removes the previous passkeys.
• Sessions. Session cookies are host-only, secure and HTTP-only, and expire after seven days. Every dashboard change also needs a same-origin request and a session-bound anti-forgery token.
• Attempt limits. Sign-in, registration and recovery attempts are rate limited per network.

Keys and agent access

• Scoped API keys. Keys are read-only or management, expire after 30 days, can be revoked at any time and are stored only as hashes. Keys can be limited to selected hostnames. A key is shown once.
• OAuth 2.1 for MCP clients. Agents sign in through a consent page where you approve read or management access. We support public clients with PKCE (S256) only. Refresh tokens rotate on every use, and reusing an old token or authorization code revokes the whole grant.
• Narrow token scope. OAuth access tokens last one hour and work only on the MCP endpoint, not the REST API. You can disconnect any app from the dashboard.
• Management needs a paid plan. Agents act only on hostnames in your own account, and blocks, lockdowns and policy changes are recorded as events.

Your API and origin

• Ownership first. Protection starts only after DNS ownership is verified, the origin lock is tested and routing is confirmed.
• Origin lock. Your origin accepts only requests carrying a private origin key. That key is encrypted at rest and returned only through authorized setup flows.
• Spoofing removed. Before forwarding, the gateway removes client-supplied identity, path-override and method-override headers, then adds its own caller class and verified signer headers.
• Verified agents. Web Bot Auth signatures are verified with Ed25519 keys fetched only from signer origins you choose to trust. A User-Agent name is never treated as verified identity.
• Signed webhooks. Event deliveries to your origin are signed with HMAC-SHA256 over a timestamp and the body, so your application can reject forgeries and replays.

Team access and alerts

Enterprise owners can invite existing registered teammates as viewers or operators. Membership and contract status are checked on every request. Operators cannot change billing, origin secrets, account email or integration keys. Paid plans can export retained control-audit records.

Verified account owners may opt in to security email summaries. Recorded restrictions, blocks and lockdown changes are checked on the next scheduled run, usually within a minute. Summaries are limited to one per hostname, event type and 15-minute period, and eight per account per day, subject to shared mail capacity. Origin alerts require repeated scheduled evidence and can miss short outages. Delivery is not guaranteed. Security mail uses security@webupcheck.com; replies go to support@webupcheck.com.

Payments

• Stripe-hosted checkout. Card details go directly to Stripe and never reach WebUpCheck.
• Verified billing events. Billing webhooks are signature-checked with a five-minute tolerance, and subscription state is re-read from Stripe before any plan changes.
• Contract plans protected. Enterprise contracts are assigned by us and cannot be changed by a billing event.

Data we keep

• Protection events. Restrictions, blocks and configuration changes are kept for 24 hours on Free, 30 days on Protect, 90 days on Scale and up to 365 days on Enterprise. Events identify callers by keyed hashes, not raw IP addresses.
• Not request logs. We do not store request or response bodies. Short-lived caller state is held only as long as rate limits need it.
• No reputation lists. No external attacker reputation feed is used for blocking.
• Diagnostics. The free checker's data handling is described in our privacy notice.

Website hardening

• Browser policies. Pages are served over HTTPS with HSTS, a restrictive Content Security Policy and framing disabled.
• Bounded requests. Public API and MCP endpoints limit request size and processing time.
• Tested. Authentication, authorization, billing and gateway behavior are covered by automated security tests.

Known gaps

We do not offer these today. Do not rely on them in a procurement or risk assessment:

• No SOC 2, ISO 27001 or other certification.
• No completed third-party penetration test.
• No availability SLA or uptime guarantee.
• No single sign-on. Team members use their own passkey accounts; Enterprise provides viewer and operator roles.
• No customer-managed encryption keys or data-residency options.
• Signed-agent verification does not yet track one-time nonces, so a captured signature stays valid until it expires.
• Protect is a behavioral layer. It is not a full web application firewall and not unlimited DDoS absorption.

Enterprise customers can ask about single sign-on, availability commitments and security questionnaires; these are on our roadmap. See plans.

Report a vulnerability

Email security@webupcheck.com with the subject “Security report”. Include steps to reproduce and the affected URL. Please test only against accounts and APIs you own, do not access other customers' data, and avoid tests that degrade the service. We will acknowledge your report and keep you updated while we fix it. We do not run a paid bug bounty.