Methodology
Current scoring method: version 2.
What is read
Only public information: DNS records from public resolvers (DNS over HTTPS), Certificate Transparency logs, and ordinary GET requests for the homepage over HTTPS and HTTP. Nothing is logged in to, submitted, scanned for ports or modified. This is not penetration testing and not application assurance: it says nothing about the application's code, servers, accounts or data.
Optionally, only when someone clicks "Check agent access" on a result, up to 3 more GET requests are made, one at a time: /robots.txt, /llms.txt, /.well-known/security.txt. See "Agent access & discovery signals" below.
Checks and weights
Category weights (sum 100):
| Check | ID | Weight |
|---|---|---|
| Email security · 30 | ||
| SPF — who may send mail for the domain | spf | 10 |
| DMARC — anti-spoofing policy | dmarc | 15 |
| DKIM — digital signature on email | dkim | 5 |
| MX — inbound mail routing | mx | 0 (informational) |
| Encryption & certificate · 25 | ||
| HTTPS available | https | 10 |
| HTTP → HTTPS redirect | redirect | 7 |
| SSL/TLS certificate validity | cert | 8 |
| Browser protections · 30 | ||
| HSTS — enforce encryption in the browser | hsts | 8 |
| CSP — protection from script injection | csp | 8 |
| Clickjacking protection | clickjacking | 5 |
| X-Content-Type-Options | xcto | 4 |
| Referrer-Policy | referrer | 3 |
| Permissions-Policy | permissions | 2 |
| Software version disclosure | leakage | 0 (informational) |
| DNS infrastructure · 15 | ||
| DNSSEC — signed DNS records | dnssec | 7 |
| CAA — who may issue certificates | caa | 5 |
| DNS server redundancy | ns | 3 |
Check states
- Pass / needs attention / fail — the check was assessed from a conclusive public answer and earns all, part or none of its weight.
- Inconclusive (unverified) — a lookup failed or timed out, or the fact can't be observed passively. It earns nothing and its weight is removed from the denominator; it is never counted as a failure.
- Excluded (not applicable) — the check doesn't apply (for example, web header checks when the domain has no website). Its weight is removed from the denominator.
- Informational — weight 0; shown for context, never changes the score.
How the score is calculated
Score = points earned on assessed checks ÷ total weight of assessed checks × 100, rounded. Coverage = assessed weight ÷ eligible weight (eligible = all weights minus not-applicable checks). If nothing can be assessed, there is no score or grade. A confirmed critical finding backed by public evidence caps the score at 69; unverified checks never trigger the cap. Scores from different method versions, or with different sets of assessed checks, are not compared directly.
Grades: A ≥ 90, B ≥ 80, C ≥ 70, D ≥ 60, F ≥ 0.
DKIM
DKIM keys live under selector names that can't be listed from public DNS. Common selectors are tried (google, selector1, selector2, default, k1, s1, s2, dkim, mail, smtp). If none are found, DKIM stays unverified — that is not evidence that DKIM is missing.
HSTS
Strict-Transport-Security helps browsers use HTTPS on future visits after they have received the policy. It does not protect the very first visit unless the domain is on a browser preload list.
Agent access & discovery signals (optional, unscored)
A separate section on the results page, run only on request. It never changes the score or grade and has no readiness percentage. It requests at most 3 public files (/robots.txt, /llms.txt, /.well-known/security.txt) sequentially over HTTPS with a self-identifying user agent (no crawler impersonation), at most 3 redirects (each hop re-checked against private and reserved addresses), a 5-second limit and size limits of 512 KiB (robots.txt), 256 KiB (llms.txt) and 32 KiB (security.txt). Results are cached for 24 hours. File content is treated as data, never as instructions. Rate-limit and CDN hints reuse the homepage response headers already fetched.
- States — observed (file returned), not advertised (4xx, or a web page returned instead of a text file), unavailable (server error, timeout, oversized or blocked redirect).
- robots.txt — evaluated per RFC 9309 for the homepage path "/" for named crawlers by role: Search (Googlebot, Bingbot); AI search (OAI-SearchBot, Claude-SearchBot, PerplexityBot); AI training (GPTBot, Google-Extended, ClaudeBot, CCBot); User-triggered (ChatGPT-User, Claude-User, Perplexity-User). The bot's own group(s) apply, otherwise the "*" group; the longest matching rule wins and an Allow wins a tie. The result is labelled "Declared robots rule for /" (allow, disallow, no rule, or unknown) and the matching rule and line are shown. A missing file (404) or an empty file declares no rules; a file that is not readable as robots.txt (e.g. an HTML page or no recognizable records) or that failed to fetch is shown as unknown. Paths are compared after RFC 9309 percent-encoding normalization. robots.txt is not access authorization, and this never indicates actual crawler reachability or ranking; user-triggered fetchers may follow different vendor policies. Blocking AI training is never treated as a problem. Crawler list version 2026-11-05, taken from each vendor's documentation. No request is sent with a crawler's user agent.
- llms.txt — whether it is present and has content.
- security.txt (disclosure hygiene) — whether there is a valid Contact and a single valid, unexpired Expires (RFC 9116).
- Rate-limit headers — RateLimit / Retry-After are "advertised" or "not observed"; not observing them never means there is no rate limit.
- CDN hints — provider names suggested by response headers only; this does not detect or rate a firewall.
What a grade is not
A grade is a snapshot of public configuration at the scan time. A good grade is not a certification, an audit result or a security guarantee, and compliance tags are indicative only.