What is Outpost for? When a website breaks, the hard part is rarely noticing. It is knowing where it is hosted, who has the login, and who to phone. Outpost keeps those answers for every site you run, watches the sites, and when one breaks, sends one alert that says which part failed and who can fix it.
How do I add a site? Choose “Add site” and enter its domain, such as example.co.za. Outpost looks at it from outside for about a minute and fills in what it can see. Then answer the questions it could not: who holds each login, and where the backups are.
What should I write for a login? Where it is kept and who has it, such as “Finance team, in the shared vault”. Never the password itself: Outpost has nowhere to store one. If nobody knows, choose “Don’t know”; it stays on the list as a question to chase.
Why does Outpost ask? A full scan shows exactly where a site is weak, which is as useful to someone attacking it as to its owner. So Outpost shows the detail only to whoever can prove the site is theirs.
How? Outpost gives you one line of text to add to the domain’s DNS, as a TXT record named _outpost. The page says what to put in each box, finds your DNS provider for you, and can write an email with the instructions for whoever looks after your domain. It does not change how your website or email works. If you cannot reach the DNS, you can put the line in a file on the website instead.
It says the record was not found. A new record usually shows within a few minutes and sometimes takes up to an hour. Check the name is _outpost and the value is pasted whole, then press “Check now” again later. Leave the record in place afterwards: Outpost looks for it every day.
Is it safe for my site? Yes. Outpost only makes the requests a visitor or a search engine makes: it reads public pages and a short fixed list of public files. It never logs in, never sends a form, and never tries to guess hidden addresses. Every request names Outpost, so it is easy to recognise in your logs.
What does it check? That the site is up and showing its real page; the domain registration and certificate, and when they expire; who hosts the DNS and the site; what the site is built with and what it gives away publicly; whether Google lists it as dangerous; and whether search engines are shown something visitors are not, a common sign of a hacked site.
When does Outpost tell me a site is down? After three checks in a row have failed, so a single hiccup does not wake anyone. Once a check fails, the site is checked every minute, so an outage is confirmed within a few minutes. You get one message when it goes down and one when it is back.
Who gets them? Everyone in the account, by email. On Business they also go to Slack, naming the part that broke, who holds its login and the first steps from your runbook. Connect Slack in Settings.
What counts as urgent? A site that looks hacked or is on Google’s list of dangerous sites, and a domain or certificate that has run out or will within a week. These are emailed at once on every plan. Everything else is in your weekly or monthly summary.
What is the difference? Free watches 1 site with 2 people, checked once a day. Business watches 5 sites with 3 people, checked every five minutes, with Slack alerts, the full history as it happens, a weekly summary, fire drills and “what if”. See the pricing.
What if I move to a smaller plan, or a payment fails? Nothing is deleted and no site stops being watched. Sites are checked on the Free plan’s schedule, and the history appears again when you move back. A failed payment keeps your plan for seven days while it is tried again.
Who can do what? Owners can do everything, including inviting and removing people. Editors can change the registry, sites and runbooks. Viewers can read everything and change nothing. Invite people on the Team page.
Why two owners? So the account is never left with nobody able to manage it. Outpost reminds you until there are two.
Someone has left. What now? Remove them on the Team page. Before you do, Outpost lists every login the registry says they hold, so you can move those too. If every owner has gone, someone with an email address at your organisation’s domain can recover the account by adding a DNS record.
Can I take my data with me? Yes. Download what Outpost holds about you from the Team page, and owners can download everything in an account from Settings.
How do I delete my account? An owner can delete it in Settings, which removes everything in it. You can delete your own login from the Team page. See the privacy policy for what is kept and for how long.
Something else? Write to Vincent@codeandvin.com.