diff --git a/modules/nixos/web-services/scrutiny.nix b/modules/nixos/web-services/scrutiny.nix
index e0be952..0789008 100644
--- a/modules/nixos/web-services/scrutiny.nix
+++ b/modules/nixos/web-services/scrutiny.nix
@@ -1,4 +1,9 @@
-{ config, lib, ... }:
+{
+  config,
+  self,
+  lib,
+  ...
+}:
 let
   cfg = config.custom.web-services.scrutiny;
 in
@@ -16,6 +21,11 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    assertions = lib.singleton {
+      assertion = self.lib.isPrivateDomain cfg.domain;
+      message = self.lib.mkUnprotectedMessage "Scrutiny";
+    };
+
     services.scrutiny = {
       enable = true;
       settings.web.listen = {
diff --git a/modules/nixos/web-services/searxng.nix b/modules/nixos/web-services/searxng.nix
index ff83745..c79ab0d 100644
--- a/modules/nixos/web-services/searxng.nix
+++ b/modules/nixos/web-services/searxng.nix
@@ -1,4 +1,9 @@
-{ config, lib, ... }:
+{
+  config,
+  self,
+  lib,
+  ...
+}:
 let
   cfg = config.custom.web-services.searxng;
 in
@@ -16,6 +21,11 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    assertions = lib.singleton {
+      assertion = self.lib.isPrivateDomain cfg.domain;
+      message = self.lib.mkUnprotectedMessage "SearXNG";
+    };
+
     services.searx = {
       enable = true;
       settings = {