Description
BeleGuard Domain Scanner checks your subdomains for “dangling CNAME” records: DNS entries that still point to a cloud resource (GitHub Pages, Heroku, Amazon S3, and others) that has since been deleted or deprovisioned. If an attacker claims that same resource name on the cloud provider, they can serve content — including phishing pages — under your own trusted domain.
Free version: scans a list of common subdomain prefixes of your own domain, and scans the outbound links found in your published posts and pages for third-party subdomains that may have been abandoned by the sites you link to.
Pro version: reads your real DNS zone directly through your DNS provider’s API (Cloudflare or Amazon Route53) instead of guessing subdomains from a wordlist — exhaustive, no false negatives from an incomplete wordlist, and works even when your domain is behind the Cloudflare proxy.
External services
This plugin connects to the following third-party services:
Cloud provider domains — when a scanned subdomain’s CNAME record points to one of the domains below, the plugin makes a plain HTTP request to that subdomain (your own domain’s DNS record, not the provider’s site) to confirm whether the resource is unclaimed. No data beyond the request itself is sent.
- github.io (GitHub / GitHub Pages) — Terms of Service, Privacy Statement
- herokuapp.com (Heroku / Salesforce) — Salesforce-Heroku Master Subscription Agreement, Privacy Policy
- s3.amazonaws.com (Amazon S3 / AWS) — Service Terms, Privacy Notice
- azurewebsites.net (Microsoft Azure) — Legal Information, Privacy Statement
- myshopify.com (Shopify) — Terms of Service, Privacy Policy
- fastly.net (Fastly) — Terms of Service, Privacy Policy
- zendesk.com (Zendesk) — Terms of Use, Privacy Policy
- uservoice.com (UserVoice) — Terms of Service, Privacy Policy
- domains.tumblr.com (Tumblr / Automattic) — Terms of Service, Privacy Policy
- unbouncepages.com (Unbounce) — Terms of Service, Privacy Policy
- surge.sh (Surge) — Terms of Use, Privacy Policy
- wordpress.com (WordPress.com / Automattic) — Terms of Service, Privacy Policy
Cloudflare API (api.cloudflare.com) — Pro version only
Used to read your DNS zone’s records directly, using an API token you create and provide yourself. Privacy Policy
Amazon Route53 API (route53.amazonaws.com) — Pro version only
Used to read your DNS hosted zone’s records directly, using AWS credentials you create and provide yourself. AWS Privacy Notice
Freemius (freemius.com) — Pro version only
Used to manage the license and subscription for the Pro plan. Account and billing data entered at checkout is sent to and processed by Freemius as merchant of record.
Privacy Policy –
Terms of Service
Installation
- Upload the
beleguard-domain-scannerfolder to/wp-content/plugins/. - Activate the plugin from the “Plugins” menu in WordPress.
- Go to Settings > BeleGuard Domain Scanner to run your first scan.
FAQ
-
Does the plugin modify my site or my DNS?
-
No, BeleGuard Domain Scanner is read-only: it only reads DNS records and public HTTP responses to detect abandoned cloud resources. It never creates, modifies, or claims any resource.
-
What data is sent outside my site?
-
On each scan of your own subdomains, the plugin resolves DNS records for a list of common subdomain prefixes of your domain, and makes a plain HTTP request to any subdomain whose DNS record matches a known cloud provider pattern, to confirm whether the resource is unclaimed. No personal data, site content, or user data is sent.
The Pro version additionally connects to your DNS provider’s API (Cloudflare or Amazon Route53) using credentials you provide yourself, to read your DNS zone’s records. These credentials are stored in your site’s database and are never transmitted anywhere except directly to the DNS provider’s own API.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“BeleGuard Domain Scanner” is open source software. The following people have contributed to this plugin.
Contributors
Translate “BeleGuard Domain Scanner” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
0.1.2
- Pro plan (Cloudflare and Amazon Route53 integrations) is now available for purchase.
0.1.1
- Added Terms of Service and Privacy Policy links for each cloud provider domain referenced in the dangling-CNAME fingerprint check (WordPress.org review feedback).
0.1.0
- Initial release: scan of common subdomains for dangling CNAME records, scan of outbound content links, Pro integrations with Cloudflare and Amazon Route53 APIs.