API

Everything the dashboard shows is available as JSON. Create a token in Settings and send it as a bearer token. Limit: 120 requests a minute.

curl https://ishacked.com/api/v1/sites -H "Authorization: Bearer ih_…"

Method	Path	What it does
`GET`	`/account`	Plan, site limit, on-demand allowance, alert channels
`GET`	`/sites`	All sites with status, issue count and top issue
`POST`	`/sites`	Add sites: `{"urls": ["https://a.com", "b.org, Client label"]}`
`GET`	`/sites/:id`	Findings, the full checklist, accepted keys and the latest raw snapshot
`PATCH`	`/sites/:id`	Set the label or client recipients: `{"label": "Acme", "alert_emails": ["[email protected]"]}`
`DELETE`	`/sites/:id`	Stop monitoring a site
`POST`	`/sites/:id/check`	Check now (202 when queued, 429 when cooling down or out of allowance)
`POST`	`/check-all`	Check every site now, within the daily allowance
`GET`	`/sites/:id/scans`	The last 60 scans: status, findings, new keys
`GET`	`/sites/:id/scans/:scanId`	One scan, with its full snapshot for the latest 10

Run a check after every deploy

curl -fsS -X POST https://ishacked.com/api/v1/sites/$SITE_ID/check -H "Authorization: Bearer $HACKBEACON_TOKEN"

Webhook payload

Sent for new high and medium issues (alert) and when a site is clean again (resolved). text and content let Slack and Discord display it as is.

{
  "event": "alert",
  "site": { "id": "6f1c…", "url": "https://client-shop.com/" },
  "report_url": "https://ishacked.com/app/sites/6f1c…",
  "findings": [
    { "key": "cloak-spam:casino", "severity": "high", "category": "seo",
      "title": "Googlebot sees spam that visitors do not", "detail": "…", "evidence": ["casino"] }
  ],
  "text": "⚠️ IsHacked: 1 new issue(s) on client-shop.com …",
  "sent_at": "2026-10-16T12:00:00.000Z"
}

Finding keys

Each finding has a stable key, for example spf-lookups, tls-expiring:14 or wp-user:adminbackup. Alerts fire once per key, and marking a key as expected silences it for that site.