Add your Trust Badge
in two minutes.

Preview & install your badge

Try the styles below to see exactly what your visitors will see. When you’re ready, your personalized code is waiting in your dashboard - no coding skills needed.

<div class="pcrisk-badge"
     data-style="shield"
     data-size="medium"
     data-theme="light"
     style="min-width:214px;min-height:141px;font-size:0;line-height:0"></div>
<script src="https://scanner.pcrisk.com/badge/trust-badge.js" defer></script>

Platform guides

Two ways to add the badge: install our plugin, or paste the snippet from your dashboard. Pick your platform below - either way it takes a few minutes.

Customize your badge

Your choices live as data-* attributes on the snippet’s placement <div> - the dashboard designer sets them all when it generates your code. To restyle later, pick a new look there and paste the updated snippet over the old one. Here’s what each attribute controls.

Badge not showing up?

Work through these in order - the first two solve the large majority of cases.

script-src  https://scanner.pcrisk.com
connect-src https://scanner.pcrisk.com
style-src   'unsafe-inline'

How your visitors verify it

A badge anyone can fake builds no trust. Ours is independently verifiable - that’s what makes it worth displaying.

What happens if a threat is detected

You’ll never display a “verified” seal on a compromised site.

Slack & webhook alerts

Get the same alerts we email - threat found, all clear, scan couldn’t complete - pushed to Slack or to your own endpoint, at the same moments. Configure both in your dashboard under Settings → Alert integrations.

Slack

In Slack, create an Incoming Webhook for the channel you want (Slack: Apps → Incoming Webhooks → Add to a channel), paste the hooks.slack.com URL into your dashboard, and press Send Slack test. That’s the whole setup - no code needed.

Webhooks

We POST JSON to your HTTPS endpoint. Four event types:

• alert.opened - a scan flagged the site (score below 70); the badge is paused.
• alert.resolved - a later scan came back clean; the badge is restored.
• scan.failed - the daily scan couldn’t complete (site unreachable); sent once per outage.
• test - the dashboard’s Send webhook test button.

{
  "event": "alert.opened",
  "domain": "example.com",
  "trust_score": 55,
  "threat_type": "suspicious",
  "severity": "medium",
  "occurred_at": "2026-07-07T08:28:36.874Z"
}

Each request carries three headers: Content-Type: application/json, X-PCrisk-Event (the event type), and X-PCrisk-Signature - sha256= followed by the hex SHA-256 HMAC of the raw request body, keyed with the signing secret shown in your dashboard. Verify it before trusting a delivery.

Delivery semantics: we wait up to 5 seconds for a response and count any 2xx as accepted; a failed delivery is retried once, ~15 seconds later, then dropped. Treat webhooks as notifications, not as a ledger - your dashboard is the state of record.

const crypto = require('crypto');
const express = require('express');
const app = express();

// express.raw keeps the body as the exact bytes we signed
app.post('/hooks/pcrisk', express.raw({ type: 'application/json' }), (req, res) => {
  const expected = 'sha256=' + crypto
    .createHmac('sha256', process.env.PCRISK_WEBHOOK_SECRET)
    .update(req.body) // Buffer
    .digest('hex');
  const given = req.get('X-PCrisk-Signature') || '';
  const ok = given.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(given), Buffer.from(expected));
  if (!ok) return res.status(401).end();

  const event = JSON.parse(req.body);
  console.log(event.event, event.domain, event.trust_score);
  res.status(200).end(); // any 2xx marks the delivery as accepted
});

app.listen(3000);

<?php
$secret   = getenv('PCRISK_WEBHOOK_SECRET');
$raw      = file_get_contents('php://input'); // raw body, before any parsing
$given    = $_SERVER['HTTP_X_PCRISK_SIGNATURE'] ?? '';
$expected = 'sha256=' . hash_hmac('sha256', $raw, $secret);

if (!hash_equals($expected, $given)) {
    http_response_code(401);
    exit;
}

$event = json_decode($raw, true);
// $event['event'], $event['domain'], $event['trust_score'], ...
http_response_code(200); // any 2xx marks the delivery as accepted

import hashlib, hmac, os
from flask import Flask, request, abort

app = Flask(__name__)
SECRET = os.environ["PCRISK_WEBHOOK_SECRET"].encode()

@app.post("/hooks/pcrisk")
def pcrisk_hook():
    raw = request.get_data()  # raw body, before parsing
    expected = "sha256=" + hmac.new(SECRET, raw, hashlib.sha256).hexdigest()
    given = request.headers.get("X-PCrisk-Signature", "")
    if not hmac.compare_digest(expected, given):
        abort(401)

    event = request.get_json()
    # event["event"], event["domain"], event["trust_score"], ...
    return "", 200  # any 2xx marks the delivery as accepted

# run with: flask --app hook run --port 3000

Rotating your endpoint? Save the new URL in the dashboard and send a test - the signing secret stays the same for your account. Alerts are per-incident (one alert.opened per below-70 episode, not one per scan), so your channel won’t be flooded by a site that stays flagged.

REST API

Pull your domains, scores, scan history and alerts into your own dashboards, reports and monitoring. Read access on Pro; the Business plan adds domain management. The API only ever exposes your own monitored domains.

Authentication

Create a key in your dashboard under Settings → API keys (it’s shown once - we store only a hash) and send it as a Bearer token. Keys inherit their permissions from your current plan, and revoking one in the dashboard disables it immediately.

curl https://scanner.pcrisk.com/api/v1/domains   -H "Authorization: Bearer pcrisk_live_YOUR_KEY"

{
  "success": true,
  "data": [
    {
      "domain": "example.com",
      "status": "verified",
      "trust_score": 92,
      "threat_type": "clean",
      "last_scanned": "2026-07-07T06:12:04.000Z",
      "open_alerts": 0,
      "badge_visible": true,
      "badge_live": true
    }
  ]
}

Endpoints

GET /api/v1 - discovery: your plan and tier.
GET /api/v1/domains - all your domains with current score, threat type and badge state.
GET /api/v1/domains/{domain} - one domain.
GET /api/v1/domains/{domain}/history - scan-score trail (history depth follows your plan).
GET /api/v1/alerts - latest threat alerts across all domains, open and resolved.
POST /api/v1/domains (Business) - add a domain; monitoring starts immediately. Body: {"domain": "example.com"}.
DELETE /api/v1/domains/{domain} (Business) - remove a domain; scans stop, the badge stops rendering.

Try it

Paste an API key from your dashboard (Settings → API keys) and call any read endpoint right here. The key goes only into this one request, to this site - nothing is stored, and the request counts against your rate limit like any other.

Conventions: every response is JSON with success and either data or error.code + error.message (401 bad key, 403 plan/tier, 404 not yours, 429 rate limited). Rate limit is 60 requests/minute per key - watch the X-RateLimit-Remaining and Retry-After headers.