Frequently asked questions

Gmork is a website watchdog. It checks your site from the outside, the way a visitor or a search engine sees it, and tells you in plain words when something is actually wrong: a page that changed, a checkout that stopped working, spam that only Google sees, or a certificate about to expire.

An uptime monitor asks whether the server answers. Gmork also asks whether the website is okay: whether the content is what you expect, whether key journeys like signup or booking still work, whether Googlebot sees the same page as visitors, and whether something suspicious was injected.

No. Gmork only looks at public pages, the way a visitor would. It does not try to break in, guess passwords, or test for software vulnerabilities. That also means it cannot prove a site is clean.

No. There is nothing to install. To unlock continuous watching you prove you control the domain with a DNS TXT record, a small file, or a meta tag.

Yes. The check at gmork.com/hacked-check is free and needs no account. To keep it fair it is limited to 5 checks per visitor every 15 minutes.

It loads your homepage as a normal visitor, as Googlebot, and as someone arriving from a Google search, then looks for visible signs of a hack: sneaky or conditional redirects, injected or scrambled scripts, hidden spam links, crypto-miners, and unexpected frames. It also reports which recommended security headers are present.

No. It only sees what is publicly visible on the homepage at that moment. Some attacks only show to certain visitors, on certain pages, or at certain times. A clean result means no visible warning signs were found, not that the site is guaranteed to be clean.

Only for domains that are verified in a Gmork account. Those checks report whether a sensitive file is readable, never its contents. The free public check never probes for files.

Strict-Transport-Security (HSTS), Content-Security-Policy, X-Frame-Options (or the CSP frame-ancestors rule), X-Content-Type-Options, Referrer-Policy and Permissions-Policy. It also notes when the Server or X-Powered-By header reveals software versions.

No. Security headers are hardening: they make some attacks harder or limit the damage. A missing header is advice to improve, not evidence of a compromise.

The homepage you enter, after following redirects. Headers can differ between pages, so check important pages separately if they are served by a different system.

Yes, with no account. It is rate limited so that everyone can use it, and every site added to Gmork gets the same header check on each run.

Basic is free for 1 domain. It covers uptime, SSL, broken links and basic SEO health, with on-demand checks, limited history and a weekly report.

Only the number of domains and the price. Every paid plan has the same full watchdog: continuous monitoring, change detection, Google appearance and cloaking checks, journeys, lookalike domains, alerts and the daily briefing.

Yes. Annual billing is two months free: $100, $150, $200, $300 or $500 per year depending on the plan. Basic stays free.

The free public checks work on any public site. The full watchdog runs only on domains you verify, with a DNS TXT record, a file, or a meta tag, so nobody can point Gmork at a site they do not control.

No. They are separate products. Website plans monitor websites you run. Gmork Scam Guard is a browser extension for you and your family, with its own plans (free for home use, AI plans from $4 a month, and Workplace plans for businesses, each with a 14-day free trial) and no website or domain needed.

No. Journeys stop before payment. They never fill card, CVV or password fields, never click buttons like pay, place order, purchase or confirm booking, and block requests to payment processors.

No. The cloaking check compares the page your server returns to Googlebot with the page it returns to a normal browser. Optional search-result monitoring uses an official search API (Brave Search or Google Programmable Search) when it is configured.

No. It lists domains that look like yours and are live, with how similar their homepage is, and says they may be impersonating you. Deciding what to do is up to you.