All features — explained in full with live preview
The XICTRAQ documentation explains every module step by step — what it does, where to find it in the dashboard, how to configure it and what the result looks like. Every section includes a live preview with sample data and cross-links to the real app.
Getting started
Monitoring modules
HTTP/TCP checks, multi-node, from 30s interval, SLA reports.
Certificate expiry, chain validation, cipher suites, early warnings.
CSP, HSTS, X-Frame-Options, Referrer-Policy with scoring and recommendations.
SHA-256 baseline of external third-party scripts, cron re-check, drift alert against web skimming/Magecart. Business and above.
A/AAAA/MX/NS/TXT, SPF/DKIM/DMARC, change detection.
RDAP registry record, expiry date, registrar changes, nameserver changes.
Lighthouse, LCP/CLS/TBT, TTFB, trend charts per viewport.
Multi-viewport, Y-shift alignment, stability rescan, changelog with slider.
Broken links, meta tags, structured data, sitemaps, on-page signals.
BFSG/WCAG (axe-core), cookie-banner detection, mixed content, privacy headers.
Self-assessment across ten measure areas, applicability pre-check, reporting-deadline timer, supply-chain register, PDF record. Preparation, not legal advice. Business and above.
SBOM-like component list from the detected tech stack, CVE notices (offline heuristic, distro-backport caveat), CycloneDX export, CRA deadlines with escalation. No real dependency scan, no conformity assurance. Business and above.
Analytics stack
Pageviews, sessions, devices, geo, channels, UTM, web vitals — no banner.
Toggles, sample rate, mask selectors, URL exclusion — live without re-embed.
Fire custom events, revenue, cart, identify, A/B and consent straight from JavaScript.
Patch level, order status and order import through the Admin API, with eight read permissions — including orders created in the shop admin. Order import on Business and above.
Form funnels, field drop-off, video/audio engagement, click heatmaps.
rrweb-based, automatic privacy masking, built-in player, GDPR-compliant.
Two-proportion z-test, uplift and p-value, automated anomaly insights.
Share of model: measures whether AI answers mention your brand — citation rate, share of voice, sentiment, your own questions & regions. Business and above.
Operations
Monitor cron jobs, test API endpoints with assertions.
Playwright-based synthetic checks: login flows, checkout, forms.
22 scan sections, auto-discovery via industry + postal code, auto-scans with change alerts, 3 dashboard tabs, printable benchmark report.
Email, Slack, Teams, Discord, Telegram, webhook, browser push + escalation.
Auto-creation for critical alerts, acknowledge, resolve, timeline, postmortem.
Platform status, customer status page with custom domain, subscribers, widget.
Weekly email report, monthly PDF with up to 19 sections, auto-delivery.
Free tools
AI & advice
Account & integration
Invite team members, roles, client portal with own branding.
Give customers read-only access to assigned websites — Agency: 50 slots.
REST API, API keys, webhooks for every event, embeddable status widget.
Country, region, city, coordinates, timezone, ASN/provider for any IP — EU-hosted, API keys with scopes + .mmdb download.
Embed status badge + audit lead magnet as JS snippet on any page.
Switch plans, add-ons, 14-day trial, Stripe customer portal, invoices.
Name, email, language, billing address, VAT ID, delete account.
2FA (TOTP/passkeys), strong password, active sessions, login history.
Suppress alerts during planned deployments, one-time or cron-based.
Full-page screenshots on 50+ devices + custom pixels — add-on for launch reviews.
Changelog
Check intervals
The uptime check is configurable per website; the shortest interval allowed depends on your plan (Free 5 minutes, Starter and Business 1 minute, Agency 30 seconds). All other checks run on a fixed schedule and are not configurable per website. A scan you start yourself measures immediately and does not wait for the next cycle.
| Check | Free | Starter / Business / Agency |
|---|---|---|
| SSL certificate | daily | every 6 hours |
| Security headers | daily | every 6 hours |
| Sitemap changes | daily | every 12 hours |
| robots.txt | daily | every 12 hours |
| Domain expiry (RDAP) | daily | daily |
| Google Safe Browsing | daily | every 6 hours |
| Blacklist (DNSBL) | daily | every 6 hours |
| TCP port check | daily | every 6 hours |
| DNS records | daily | every 6 hours |
| Broken links | daily | every 12 hours |
| Lighthouse (performance) | daily | every 12 hours |
| Real-user CWV (CrUX) | daily | every 12 hours |
| Accessibility (WCAG) | daily | every 12 hours |
| Screenshot (desktop/tablet/mobile) | daily | every 12 hours |
| Technology stack | daily | daily |
| SEO meta & structured data | daily | every 12 hours |
| Network (ASN, PTR, CDN) | daily | every 12 hours |
| Subpage monitoring | per uptime check | per uptime check |
The same table is shown in the app under Website → Further checks.
Firewall whitelist
If your firewall, Fail2Ban or WAF blocks datacenter traffic, our checks are blocked too — the site then looks offline when it is not. Allow the addresses of the monitoring nodes below. The list is read live from the platform and changes whenever a location is added or removed.