Every check reads publicly available information — nothing here logs in, guesses passwords, or probes for vulnerabilities. This page explains exactly what's checked, how the score is calculated, and where the real limitations are.
A scan runs six categories of checks in parallel and combines them into a single 0–100 score. Each category has a fixed weight:
| Category | Weight | What it looks at |
|---|---|---|
| Email authentication | 25 | SPF, DMARC, and DKIM records — whether mail claiming to be from your domain can be forged |
| TLS / SSL | 20 | Certificate validity and expiry, obsolete protocol support, whether HTTP redirects to HTTPS |
| Breach exposure | 20 | Whether common role addresses on your domain appear in known data breaches |
| HTTP headers | 15 | Security headers (HSTS, CSP, X-Frame-Options, and similar) and cookie flags |
| Exposed services | 15 | Open ports and known vulnerabilities on the server's public IP address |
| Software / CMS currency | 5 | Whether server software or CMS version is publicly disclosed, and whether a detected WordPress install is a major release behind current |
When a category can't be assessed (an API is down, a check times out), its weight is removed from the total and the score is rescaled across whatever did complete, so a partial scan is still comparable to a full one rather than being unfairly penalised for something outside your control.
| Score | Grade | Meaning |
|---|---|---|
| 75–100 | A | Strong |
| 60–74 | B | Good, minor gaps |
| 45–59 | C | Needs attention |
| 25–44 | D | Significant gaps |
| 0–24 | F | Urgent action needed |
Every check reads DNS records, the TLS certificate the server presents, HTTP response headers, and public breach records — checked by common role-based email address, not by proving domain ownership. Nothing probes for vulnerabilities, submits input, guesses credentials, or authenticates against anything. That's what makes it possible to scan any domain instantly, without needing the owner's permission first — the same boundary that separates "reading what's already public" from "testing a system," which is a meaningfully different (and more legally sensitive) activity.
A few categories involve a lookup against a third party, and it's worth being precise about what's actually sent:
info@ and admin@ your domain — against Have I Been Pwned's public breach database. These are guessed role addresses, not real mailboxes we've discovered; if either happens to exist and has appeared in a breach, that's what gets flagged.Everything else — email authentication, TLS, headers, and software/CMS version disclosure itself — is read directly from your own DNS records and web server's response, the same way any browser or mail server reading your site already does.
Worth understanding before treating a result as complete:
This is a point-in-time, automated, passive check — not a penetration test, not a compliance audit, and not a substitute for professional security advice. See the Terms for the full disclaimer.