Auto-checks and result emails

An auto-check scans your site on a schedule and emails you the result. Your computer doesn't need to be on, and Lockpick still only looks at what anyone online can see.

Turn it on

1. Open your site in Lockpick and choose the Auto-check tab.
2. Choose Pulse or Deep, and how often. Deep needs proof you own the site.
3. Confirm you own the site or are allowed to test it, and that you want Lockpick to keep checking it.

Checks run at about 9 in the morning in your time zone unless you pick another hour. How often you can check depends on your plan. The Free plan checks weekly with Pulse. The Deep plan checks daily with Pulse and weekly with Deep.

On the Free plan every auto-check uses a scan from your monthly allowance, the same as a scan you start. A weekly check uses about 4 scans a month, so checks on many sites can use more than your plan includes. On the Deep plan, and with Master Key or Deep early access, one Pulse auto-check per site per day is included and doesn't use the month's Pulse scans. A Deep auto-check uses a Deep scan, about 4 a month. When the month's scans run out, auto-checks that use them wait, email you, and start again by themselves when your allowance resets. What uses a scan lists everything that counts.

Renew your agreement

Lockpick checks a site on your say-so for 90 days at a time. About 7 days before that ends, you get an email with a Renew for 90 days button, and the Auto-check tab shows the same. If you don't renew, the auto-check pauses until you turn it back on.

The email after each check

• Your grade and how it moved, for example "B, up from C".
• How many issues were fixed, how many are new and how many are still open.
• Up to three of the new issues, and the one to Fix this first, with a link to its prompt for your coding assistant.
• After a Deep auto-check, any Script changes to confirm, meaning new script providers or removed integrity hashes you haven't marked as expected.
• A note when the check couldn't see as much as usual.
• A link to open the full report.

When nothing changed, the email says so in its subject, so you can tell at a glance.

When an auto-check pauses

An auto-check pauses, and emails you, when it can't do its job. The Auto-check tab says why and what to do.

• The site couldn't be reached 3 times in a row. Check that it is up, then turn auto-check back on.
• The site blocked our checks, often a firewall, a bot check or a sign-in page. Let Lockpick through, then turn auto-check back on.
• The ownership record is gone. A Deep auto-check reads your proof, the DNS record, meta tag or file, before every check.
• Your agreement ended, or the limits for the checks changed and need your agreement again.
• You paused it. Nothing is checked until you turn it back on.

Choose which emails you get

Open Settings, then Notifications, to choose what Lockpick emails you from each workspace.

For scan results you can also choose, per site, After every check, Only when something changes or Never. Sites default to after every check, and daily Pulse auto-checks to only when something changes. In that mode a daily Pulse auto-check emails you only when a new urgent issue appears, one rated Fix now or critical, compared with the previous check. After every check still emails after every run, and Never sends nothing. The bell shows new or worse findings after every check either way.

The two alerts, Critical vulnerabilities and Fixed findings that come back, also appear in the bell. Turning one off, here or with the Stop these alerts link in its email, stops both its emails and its bell notifications.

Every email has a one-click Unsubscribe link for that kind of email, with a way to undo it. Sign-in and security emails always arrive.