When you set up your Website Security account on a domain name, it will scan only the exact domain or subdomain that you entered on setup.
For example, if you set up Website Security for coolexample.com, it will not scan blog.coolexample.com and store.coolexample.com. It will scan folders on the domain that you chose at setup, so if you have Website Security set up on coolexample.com, it will also scan coolexample.com/blog.
If you want Website Security to scan separate subdomains or domain names, you need to purchase Website Security credits for each site name . For example, if you wanted to scan coolexample.com, blog.coolexample.com, and coolexample.net, you would need to purchase three Website Security credits.