What each plan includes
On watch and On call are coming soon. Until they open, each check-up is bought on its own.
| What each plan includes | One check-up | On watch | On call |
|---|---|---|---|
| Price | $9 once | $10 a month | $30 a month |
| Websites | 1 per check-up | 1 | 1 |
| Full check-ups | 1, up to 50 pages | One every 14 days | One every 14 days |
| Single checks | No | No | About 5 full check-ups' worth a month |
| Full report, fix prompts and PDF | Yes | Yes | Yes |
| REST API and MCP | No | No | 1 token |
| Report retention | 1 year | 1 year | 1 year |
| Support |
Webhooks, GitHub repo scans, custom-cadence re-scans and live monitoring are not available on current plans.
API rate limits
Every /api/v1/* and /api/mcp request is keyed on a hash of the bearer token and runs through two windows:
- Burst: 10 requests per second.
- Steady: 60 requests per minute.
On 429, the response includes:
HTTP/1.1 429 Too Many Requests
content-type: application/json
retry-after: 47
x-ratelimit-limit: 60
x-ratelimit-remaining: 0
x-ratelimit-reset: 1715116200
{
"error": "rate_limited",
"message": "Token rate limit exceeded — steady (60/min). Retry in 47s.",
"retry_after_seconds": 47
}The window which tripped is named in the message (burst (10/s) vs steady (60/min)) so a client backoff can adapt.
Scan start limit
A signed-in account can start 30 scans per 10 minutes. Requests above that return HTTP 429 Too Many Requests with a Retry-After header.
Signup throttle (per IP/24)
5 successful sign-ups per IP address range (/24) per 24 hours. Rate-limited sign-ins redirect to /sign-in?error=rate_limited.
Retention
Check-up reports stay available for one year after they finish. Audit logs are kept for 18 months. Retention runs daily through /api/cron/retention-cleanup.