docs.projectdiscovery.io

ProjectDiscovery Documentation is the central learning hub for ProjectDiscovery's open-source tools, cloud platform, and APIs. It covers four main security workflow areas: advanced exposure discovery (mapping internet-facing assets), custom vulnerability template automation, real-time vulnerability intelligence, and cloud/internal network monitoring. If you want to understand attack surface mapping, build custom detection templates, track trending exploits, or connect cloud accounts for continuous security assessment, this documentation is organized around those tasks.

Advanced Exposure Discovery

This workflow focuses on mapping your internet-exposed assets and understanding your attack surface.

What you can learn:

• How to discover and inventory externally visible hosts, services, and endpoints
• How to organize findings into a coherent view of your external attack surface
• How exposure discovery fits into a broader security operations process

This is the starting point if your goal is external reconnaissance or continuous attack surface monitoring.

Automate Custom Vulnerability

This workflow covers creating and automating custom security templates to detect vulnerabilities at scale.

What you can learn:

• How to author custom templates for vulnerability detection
• How to run those templates across many targets automatically
• How to scale detection without manually checking each asset

Use this section when built-in checks don't cover your specific stack, internal conventions, or custom applications.

Vulnerability Feed

This workflow keeps you updated with trending vulnerabilities and security exploits in real time.

What you can learn:

• How to follow newly disclosed or trending vulnerabilities
• How to use feed data to prioritize what to check or patch
• How real-time intelligence connects to the rest of your scanning workflow

This is relevant if you need situational awareness rather than a one-time scan.

Cloud Monitoring and Internal Network Security

These workflows extend beyond external assets.

Cloud Monitoring

• Connect and monitor AWS, GCP, Cloudflare, and Azure accounts for security vulnerabilities
• Learn how to link cloud accounts and interpret findings

Internal Network Security

• Secure internal networks with automated vulnerability assessment and monitoring
• Apply assessment workflows to assets that aren't internet-facing

Platform, Team, and API Workflows

Beyond detection, the documentation covers operational integration:

These matter if you're moving from individual tooling to organization-wide automation.

How to Choose Where to Start

• External attack surface focus → start with Advanced Exposure Discovery
• Custom detection needs → start with Automate Custom Vulnerability
• Staying current on threats → start with Vulnerability Feed
• Cloud or internal assets → start with Cloud Monitoring or Internal Network Security
• Team or org rollout → review Team Integrations, API Integration, and Enterprise Security Setup

The documentation also provides a search/ask interface (⌘K) and a "Talk to Our Security Experts" option for personalized guidance on implementing these workflows.

Cybersecurity is the practice of keeping your data, accounts, and services from being accessed, stolen, altered, or knocked offline by someone who shouldn't have them. For a personal site or small online presence, that reduces to a short list of concrete jobs: protect your login credentials, keep your software current, serve traffic over HTTPS, and lock down the domain and DNS layer that everything else depends on. You don't need an enterprise security team to cover the basics — but you do need to treat your registrar account and your hosting account as the two most valuable things you own, because whoever controls those controls the site.

What cybersecurity actually protects

It helps to separate the assets from the threats, because most small-site incidents come from a handful of causes.

The pattern: each asset has one or two controls that remove most of the risk. You don't need all of them on day one, but skipping the account and domain layers is the mistake that's hardest to undo.

The threat categories a small site actually faces

• Credential theft — reused or weak passwords, or credentials leaked from another breached service. This is the most common way small sites fall.
• Phishing — fake login pages or "your domain is expiring" emails designed to capture your registrar or hosting password.
• Malware and backdoors — usually arriving through an outdated CMS, plugin, or theme.
• DDoS — flooding a site until it's unreachable; often handled by your host or a CDN rather than by you.
• Misconfiguration — an open admin panel, directory listing, or default credentials left in place.

Notice that four of the five are about access, not exotic exploits. That's why the basics work.

Core protections to apply first

Use strong, unique passwords and a password manager

Every account tied to your site — registrar, host, CMS, email — should have a different password. A password manager makes this practical. The goal is that one leaked password can't be replayed anywhere else.

Turn on multi-factor authentication

MFA is the single highest-value control for your registrar and hosting accounts. Even if a password is stolen, an attacker without the second factor can't log in. Prefer an authenticator app or hardware key over SMS where the service supports it.

Serve everything over HTTPS

An HTTPS/TLS certificate encrypts traffic between visitors and your site and prevents browser "not secure" warnings. Most hosts and registrars offer a free certificate; the important part is that it's installed and that HTTP redirects to HTTPS.

Update promptly and keep the surface small

Apply CMS, plugin, and theme updates as they're released, and delete anything you're not using. Fewer components means fewer places for a known vulnerability to sit unpatched.

Apply least privilege

Give each person (and each integration) only the access they need. Don't run your site day-to-day from an administrator account, and don't hand out admin rights for tasks that don't require them.

Secure the domain and DNS layer

This layer is easy to overlook and expensive to lose, because a hijacked domain can point anywhere.

• Protect the registrar account with a unique password and MFA. Your registrar account is the root of control over the domain.
• Enable the registrar lock (often called a transfer lock or clientTransferProhibited) so the domain can't be moved without your action.
• Keep registrant contact email secure — that inbox is often the recovery path for the domain.
• Enable DNSSEC where your registrar and DNS provider support it, so responses can be cryptographically validated and spoofing is harder.
• Watch for unauthorized DNS changes — if records you didn't touch appear, treat it as a compromise.

Porkbun is an ICANN-accredited domain registrar, which means it operates under ICANN's registrar rules — relevant here because those rules govern transfers, locks, and registrant contact requirements. Its site lists Stripe among its payment platforms. Beyond that, check your specific registrar's and DNS provider's current feature set for lock and DNSSEC support, since availability varies.

Warning signs and first steps if something looks wrong

Watch for: unexpected DNS records, visitors reporting malware warnings, unexplained admin accounts, a sudden traffic drop, or emails about transfers you didn't request.

If you suspect a compromise:

1. Change passwords on registrar, hosting, and CMS accounts, starting with the registrar.
2. Revoke active sessions and reset MFA where possible.
3. Check DNS records against what you expect and revert unauthorized changes.
4. Restore from a known-good backup if files were altered.
5. Re-scan and update the software before reopening the site.

Containment first, then recovery — don't try to clean a live, still-compromised site.

What to outsource vs. manage yourself

Hosting-level security, CDN, and WAF are usually worth outsourcing because they require scale and constant attention. Account hygiene, MFA, updates, and domain/DNS protection are things you should keep in your own hands regardless of size — they're cheap to do and costly to skip.

ProjectDiscovery Documentation (docs.projectdiscovery.io) is the official documentation site for ProjectDiscovery's security tooling. It covers the company's open-source technologies, cloud platform, and APIs in one place, and it is aimed at security practitioners and organizations that want to map exposed assets, automate vulnerability detection, or run security workflows at scale. If you are evaluating whether to browse further, the site is worth opening when you need reference material or setup guidance for ProjectDiscovery products rather than general cybersecurity theory.

What the site covers

The documentation index groups its content around a few core areas:

For organizations, the site also documents operational topics such as cloud monitoring for AWS, GCP, Cloudflare, and Azure accounts, team integrations with existing ticketing and alerting tools, REST API integration for custom workflows, internal network security assessment, and enterprise security setup including SAML SSO, IP whitelisting, and custom headers.

Who it is for

The content assumes a security-oriented audience. Two broad groups are served:

• Individual practitioners and researchers who use ProjectDiscovery's open-source tools and need configuration or usage references.
• Organizations and security teams that need to connect cloud accounts, wire up alerting and ticketing, or configure enterprise-grade access controls.

If you are looking for introductory security education, this is not that kind of resource. It is product and platform documentation.

How to navigate it

The site provides a search and ask interface (shown with a ⌘K shortcut) so you can query topics directly instead of browsing the index. There is also a path to talk to security experts for personalized guidance on implementing security workflows.

A practical approach:

1. Start from the Documentation Index to see which product or platform area matches your task.
2. Use the search/ask box for specific terms such as a product name, an integration, or a configuration item.
3. For organizational rollouts, go to the "For Organizations" material covering cloud monitoring, team integrations, API integration, internal network security, and enterprise security setup.

When it is worth browsing further

Open the site if you already use or plan to use ProjectDiscovery tooling and need authoritative setup or reference details. Skip it if you want vendor-neutral security concepts or a general introduction to exposure management — the documentation is organized around ProjectDiscovery's own products and platform, not as a standalone educational resource.

Start at the documentation home page (docs.projectdiscovery.io), where a search box and a Documentation Index give you two ways in: type a product or task into search, or browse the index to see everything the docs cover. From there, pick the entry point that matches what you're trying to do — exposure discovery, custom vulnerability automation, or organizational setup — rather than reading linearly. The sections below map each goal to the right starting point.

Find the right entry point

The home page organizes content around a few primary paths:

The Get Started entry is the general on-ramp; the three topic blocks above it are task-specific. If you already know which product you're using, search is faster than browsing.

If you're working as an individual or on a single task

Use the topic blocks on the home page:

• Advanced Exposure Discovery — for mapping internet-exposed assets and understanding your attack surface.
• Automate Custom Vulnerability — for building and automating custom security templates that detect vulnerabilities at scale.
• Vulnerability Feed — for staying current with trending vulnerabilities and exploits in real time.

Each block links into the relevant documentation set, so you can go from the home page to working instructions without detouring through organizational material.

If you're setting up for an organization

The For Organizations → Get Started path covers the cloud platform and automation. From there, the documented setup areas are:

• Cloud Monitoring — connect and monitor AWS, GCP, Cloudflare, and Azure accounts for security vulnerabilities.
• Team Integrations — integrate with your existing ticketing and alerting tools.
• API Integration — build and automate custom security workflows using the REST APIs.
• Internal Network Security — automated vulnerability assessment and monitoring for internal networks.
• Enterprise Security Setup — configure SAML SSO, IP whitelisting, custom headers, and similar organization-level controls.

A practical order: connect cloud accounts first (Cloud Monitoring), then wire alerts into your existing tools (Team Integrations), then add API automation once the manual flow works. Enterprise Security Setup is worth doing before rolling out to a wider team, since SSO and IP whitelisting affect how everyone signs in.

Find advanced topics and integrations

Two entry points cover most "how do I connect this to something else" questions:

• API Integration — the REST APIs for building and automating custom security workflows. Use this when the built-in integrations don't cover your stack.
• Team Integrations — ticketing and alerting tools, for routing findings into where your team already works.

Both are reachable from the For Organizations section of the home page.

Get help from security experts

The home page includes a Talk to Our Security Experts option for personalized guidance on implementing security workflows for your organization. Use it when you need help scoping a rollout rather than looking up a specific feature — for example, deciding how to structure cloud monitoring across multiple accounts before you configure anything.

Common sticking points

• Search vs. browse: the search box (with a ⌘K shortcut) is the fastest route when you know the product or feature name; the Documentation Index is better when you're surveying what exists.
• Individual vs. organization content: exposure discovery and template automation live in their own blocks, while cloud monitoring, integrations, and enterprise setup sit under For Organizations. Starting in the wrong one is the most likely reason a topic seems missing.
• Setup order matters: integrations and API automation assume you already have accounts or monitoring connected, so do those first.

ProjectDiscovery's documentation covers cloud account monitoring, team integrations, a REST API for custom workflows, and enterprise security configuration. According to the documentation index, the cloud platform connects to AWS, GCP, Cloudflare, and Azure accounts for security vulnerability monitoring, integrates with existing ticketing and alerting tools, and supports enterprise controls such as SAML SSO, IP whitelisting, and custom headers.

Cloud Monitoring: Supported Providers

The documentation states that Cloud Monitoring lets you connect and monitor accounts from four providers:

• AWS
• GCP
• Cloudflare
• Azure

The stated purpose is to surface security vulnerabilities in those connected accounts. The page does not detail which specific services within each provider are covered, what permissions are required, or how findings are reported, so treat the provider list as the confirmed scope and verify deeper configuration details in the relevant documentation sections.

Team Integrations

The documentation describes integrations with "your existing ticketing and alerting tools." This means the platform is designed to push findings into the workflow tools your team already uses rather than requiring a separate notification channel.

The index page does not name specific ticketing or alerting products, so if you need to confirm whether a particular tool is supported, check the integration documentation directly rather than assuming coverage.

API Integration

A REST API is documented for building and automating custom security workflows. This is the path to take when the built-in integrations don't match your process — for example, if you need to trigger scans from an internal system, pull results into a custom dashboard, or chain ProjectDiscovery actions into a larger pipeline.

The documentation describes the API as "comprehensive," but the index page itself doesn't list endpoints, authentication methods, or rate limits. Those details live in the API reference.

Enterprise Security Setup

For organizations, the documentation lists configuration options including:

• SAML SSO — single sign-on for team access
• IP whitelisting — restricting access by network origin
• Custom headers — additional request-level controls

These are grouped under enterprise security setup, alongside the note that the platform is intended to scale security operations with automation.

How the Pieces Fit Together

The documentation also points to related areas: advanced exposure discovery for mapping internet-exposed assets, custom vulnerability templates for detection at scale, and a vulnerability feed for trending exploits. These sit alongside the cloud and integration capabilities rather than replacing them.

What to Check Before Committing

The index page confirms capability areas but not implementation specifics. Before adopting any of these, confirm:

1. Which services within each cloud provider are monitored — the provider list is confirmed, the service-level coverage is not.
2. Which ticketing and alerting tools have native integrations — the category is confirmed, the product list is not.
3. API authentication and limits — needed before building automation against it.
4. Enterprise feature availability — SAML SSO and IP whitelisting may be tied to specific plan tiers; the documentation index does not state pricing or plan requirements.

If your goal is simply to understand what the platform covers, the four areas above are the answer. If your goal is to implement one of them, go to that section's dedicated documentation for the configuration steps.