About this plugin
BeleGuard Domain Scanner checks your subdomains for “dangling CNAME” records: DNS entries that still point to a cloud resource (GitHub Pages, Heroku, Amazon S3, and others) that has since been deleted or deprovisioned. If an attacker claims that same resource name on the cloud provider, they can serve content — including phishing pages — under your own trusted domain.
Free version: scans a list of common subdomain prefixes of your own domain, and scans the outbound links found in your published posts and pages for third-party subdomains that may have been abandoned by the sites you link to.
Pro version: reads your real DNS zone directly through your DNS provider’s API (Cloudflare or Amazon Route53) instead of guessing subdomains from a wordlist — exhaustive, no false negatives from an incomplete wordlist, and works even when your domain is behind the Cloudflare proxy.
External services
This plugin connects to the following third-party services:
Cloud provider domains — when a scanned subdomain’s CNAME record points to one of the domains below, the plugin makes a plain HTTP request to that subdomain (your own domain’s DNS record, not the provider’s site) to confirm whether the resource is unclaimed. No data beyond the request itself is sent.
- github.io (GitHub / GitHub Pages) — Terms of Service, Privacy Statement
- herokuapp.com (Heroku / Salesforce) — Salesforce-Heroku Master Subscription Agreement, Privacy Policy
- s3.amazonaws.com (Amazon S3 / AWS) — Service Terms, Privacy Notice
- azurewebsites.net (Microsoft Azure) — Legal Information, Privacy Statement
- myshopify.com (Shopify) — Terms of Service, Privacy Policy
- fastly.net (Fastly) — Terms of Service, Privacy Policy
- zendesk.com (Zendesk) — Terms of Use, Privacy Policy
- uservoice.com (UserVoice) — Terms of Service, Privacy Policy
- domains.tumblr.com (Tumblr / Automattic) — Terms of Service, Privacy Policy
- unbouncepages.com (Unbounce) — Terms of Service, Privacy Policy
- surge.sh (Surge) — Terms of Use, Privacy Policy
- wordpress.com (WordPress.com / Automattic) — Terms of Service, Privacy Policy
com) — Pro version only
Used to read your DNS zone’s records directly, using an API token you create and provide yourself. Privacy Policy
com) — Pro version only
Used to read your DNS hosted zone’s records directly, using AWS credentials you create and provide yourself. AWS Privacy Notice
com) — Pro version only
Used to manage the license and subscription for the Pro plan. Account and billing data entered at checkout is sent to and processed by Freemius as merchant of record.
Privacy Policy –
Terms of Service