Proving a website is yours
Sentinel only checks a website when its owner asks. Before it reads a single page, you prove the site is yours. That way nobody else can use Sentinel to look for weaknesses in your website.
Three ways. Any one is enough.
When you add a website you get a code. Put it in one of these places. If someone else looks after your site, Sentinel emails them the steps.
Upload a file
Whoever can upload files to the site.
- Create a plain text file named stratic-verify.txt.
- Put the one line below in it, and nothing else.
- Upload it so it opens at https://www.example.com/.well-known/stratic-verify.txt
- File contents
stratic-verify=3f9a1c2b7d8e4f60a1b2c3d4e5f60718
- Address the file must open at
https://www.example.com/.well-known/stratic-verify.txt
Proves www.example.com only.
Add a tag to the home page
Whoever edits the site's pages. Most site builders have a box for this, often called custom code or header code.
- Add the tag below inside the <head> of the home page.
- Publish the change.
- Tag
<meta name="stratic-verify" content="3f9a1c2b7d8e4f60a1b2c3d4e5f60718">
Proves www.example.com only.
Add a DNS record
Whoever manages the domain name, usually where it was registered.
- Add a TXT record with the name and value below.
- DNS changes can take a while to spread. Check again if it is not found straight away.
- Name
_stratic-verify.example.com
- Value
stratic-verify=3f9a1c2b7d8e4f60a1b2c3d4e5f60718
Proves example.com and every address under it.
The address and the code above are examples. Yours are shown when you add your website.
The rules behind it
- The code is yours alone
- It is random, and it belongs to your account and that one address. If someone else adds your website to their account they get a different code, and yours proves nothing for them.
- It is looked for before every check
- Not only the first time. Websites are sold, rebuilt and moved. If the proof is gone, the check does not run, and you get an email. It is also looked for every 24 hours in between.
- A file or a tag proves one address
- www.example.com and shop.example.com are proven separately, because they can be different servers run by different people.
- A DNS record proves the domain and what is under it
- Whoever controls a domain's DNS controls every address under it, so one record on example.com covers www.example.com and shop.example.com.
- A redirect to another address proves nothing
- If the file's address sends the scanner to a different site, it does not follow.
- A site that is down has not lost its proof
- If your website does not answer at all, nothing changes and the check is tried again later.