Your site, your account

Claim your site

The first Trust Check from a new hostname creates an account and a Custom app for it, with 1,000 Trust Checks a week shared across everything in the account. Claiming moves that account to you. You prove control of the hostname by publishing one file.

Three steps

Sign in to the Polyguard console (with a Trust Check) and open Settings, Websites. Enter the hostname and start the claim. The link below fills it in for you.
Publish the file the console shows at https://your-hostname/.well-known/polyguard.json.
Click Verify. Polyguard fetches the file, and when the token matches, the app and its links appear in your account. If you already have an account, the hostname's account is merged into it.

https://www.example.com/.well-known/polyguard.json

{
  "site_verification": {
    "www.example.com": "pgsv_4Qm9…Xk2"
  }
}

This site publishes its own at /.well-known/polyguard.json.

The file

Serve the file at exactly /.well-known/polyguard.json over https. Redirects are not followed.
Any content type works; the body must be a JSON object under 16 KiB.
Each hostname is claimed separately. www.example.com and example.com are different hostnames, each with its own entry and token.
A value can be a list of tokens, so two people in one organization can start a claim at the same time. A hostname still belongs to one account.
Claim tokens expire after 7 days. The file is not needed once the claim succeeds.

One file for several hostnames on the same origin

{
  "site_verification": {
    "www.example.com": "pgsv_4Qm9…Xk2",
    "example.com": "pgsv_8Lp2…Qa7",
    "shop.example.com": ["pgsv_Z1c7…Rr0", "pgsv_Hn3k…Vb5"]
  }
}

What claiming gives you

The app in the Polyguard console, with its per-page links and settings.
App API keys, to send as secret on /v2/siteverify, and the option to require one.
Webhooks, if you would rather receive results than call siteverify.
Other proofs and a higher weekly limit, on request.

If another account has already claimed the hostname, verification returns an error and the hostname stays where it is. Contact Polyguard support with the published file in place and staff can move it.