Authorize your domain

Before you start

Domain authorization is the customer's explicit proof that the project host is owned by the business or approved by the site owner for automated scanning. It protects the account from running private scan delivery for the wrong site. Use this page after the project exists. The dashboard keeps Domain ownership check as a protected step under Reference links and protected steps, and the actual challenge lives on the project detail page beside Shortest path to first useful report.

Confirm the authorized domain

Follow the path `Dashboard → Shortcut paths → Get the first useful report → Project detail → Domain ownership check`. If the project domain is https://shop.example.com, do not assume https://admin.example.com or another customer domain is included. Scan only public pages that belong to the same verified project domain.

1. Open `/dashboard`, choose Get the first useful report, then open the project for the site you want scanned. Result: the project detail page shows the domain, Shortest path to first useful report and the domain ownership panel.
2. Compare the Domain value with the public site or journey you plan to scan. Result: the host, subdomain and protocol are clear before Project Pages, Billing coverage or evidence collection.
3. Read Domain authorization in the path steps. Result: you can see whether the step is Done, Now, Waiting or Blocked and which previous step must finish first.
4. In Prove this is your domain, choose DNS TXT, meta tag or file upload and click Create challenge. Result: WebRiskOps gives a customer-owned proof value without asking for provider passwords.
5. Publish the challenge on the project domain, then click Check verification. Result: the project records Domain ownership confirmed or shows the exact verification error to fix.
6. If the host is wrong, return to Projects → Add project and create a separate project for the correct site. Result: unsupported or unrelated domains do not enter Billing, Project Pages or scan setup.

Continue to account entitlements

When the domain is correct and authorized, use the Use account entitlements documentation link on this page. Billing coverage should match the authorized public project; it does not approve a different domain or a private admin area.

Blocked states

• Domain authorization required means the project needs verified ownership proof. Return to the project detail page, publish the active challenge and click Check verification.
• Domain out of boundary means the requested URL does not match the project domain. Remove it, create the correct project, or keep it out of scan setup.
• Private or internal host means the public scanner should stop. Use only supported public URLs unless a later integration path explicitly supports private or self-hosted scope.
• Project Pages required means the scan path is still waiting for discovered public pages to be reviewed.