Guides

Practical steps to secure your websites and APIs: verifying your domain, reading a scan report, and fixing the findings that come up most often.

• Phylex Scan quick start: from sign-up to your first report

  Your first steps with Phylex Scan: sign up with a work email, add a website, verify ownership, run a scan, and download the report.

• Verify asset ownership: DNS TXT, file, or RoE document

  Three ways to prove you own a website or API before Phylex scans it: a DNS TXT record, a .well-known file, or a signed RoE upload.

• Phylex Scan profiles, findings, triage, and reports

  When to use Baseline, Standard, or Threat scans; how to read severities, mark false positives, retest fixes, and choose a report format.

• Authenticated scanning: testing pages behind login

  How to set up authenticated scans in Phylex Scan: header token, session cookie, login form, or Firebase, plus the login check URL and API endpoints.

• Scheduled scans, notifications, CVE intel, and the Phylex Assistant

  Set up weekly or daily scans, understand notification emails, use CVE intel (CISA KEV) and threat scans, and ask the Phylex Assistant about findings.

• Phylex Scan plans, team members, billing, and support

  Compare Phylex Scan plans, invite team members, request or renew a subscription, understand the billing grace period, and open support tickets.

• Download your data, close an organization, and delete your Phylex Scan account

  How to download a copy of your account (JSON) and organization data (ZIP), close an organization, and delete your Phylex Scan account under Indonesian PDP law and the GDPR, including what is retained.

• Phylex Watch: monitoring your attack surface, gambling spam, and critical threats

  How to turn on Phylex Watch for a project, verify the root domain, and read the Orbit, events, gambling spam, ports, and critical threats.