How we score: no black box

Start at 100, deduct for real issues

Every site starts at 100. We evaluate 65 checks across 7 categories: 54 measured directly by the scan, and 11 scored from the answers you give afterwards about how you build and run the site. Each failed check deducts a fixed number of points by severity (with a cap per category so no single area can sink the whole score):

Your engineering practices count too

A few questions after the scan capture practices the crawler can't see. These also apply fixed deductions:

7 categories

What we request, and the two exceptions

The scan reads what your site's own page already sends any visitor: the document, its scripts, and the requests your browser makes while rendering it. Beyond that it requests exactly two well-known paths, both named below, and nothing else. There is no directory guessing and no hunting for files you did not publish: no /admin, no /.env, no backup or dump filenames. That stays out of scope for every free scan.

The first is the redirect probe. To check whether your site redirects http:// to https://, we make one extra request to the plain-HTTP version of your site's bare address (http://yourdomain/), not the specific page you asked us to scan, and the same request regardless of which page that was. That's the redirect configuration your server already advertises to every visitor who types your bare domain, and every security scanner reads it the same way. If your server doesn't answer on port 80 at all, we report that check as "not determined" rather than guess. We never turn silence into a failing grade.

The second is /robots.txt. Whether a page can appear in search results is decided in three places, and a robots meta tag and an X-Robots-Tag header are only two of them. Reading the first two and reporting a page as indexable while a Disallow rule blocks it would be a confident answer to a question we had only partly asked. So we fetch it, at the one address every crawler fetches it from, and treat the most restrictive of the three as the answer. If it times out, refuses, or comes back as something we cannot parse, that check reports as not determined too, on the same principle as the redirect above.

What has changed

A method you cannot audit is not a method. When a change alters what a scan can determine, it is recorded here with the date and with the direction it moves a score.

1. Indexability is read from all three sources

   2026-07-29 ruleset v6

   Whether a page can appear in search results is decided in three places, and we were reading two of them. This closes the last check that could report a pass over something it had not established. The ruleset is unchanged: what moved is what the scan looks at, not how a finding is scored.

   • Some scores fall The scan now fetches /robots.txt and honours a Disallow rule that covers the scanned page, alongside the robots meta tag and the X-Robots-Tag header, with the most restrictive of the three deciding. A site blocking the page in robots.txt was previously reported as indexable, and our own guidance already told owners we checked that file. This is a second well-known path the scan requests, and What we request above now names both.
   • No score change When robots.txt times out, refuses, or comes back as something we cannot parse, the check reports as not determined rather than assuming the file permits everything. A missing file is different and still passes, because no robots.txt disallows nothing.

2. Accuracy fixes across the scanner

   2026-07-29 ruleset v6

   These changed what the scan can determine and how correctly it reads a page. None of them changed how a finding is scored: the ruleset is still v6 and the arithmetic is identical. For the sites described below, a score from before this date and one from after are not strictly comparable, which is the reason this entry exists.

   • No score change A check that could not determine anything no longer reports a pass. Checks across security, performance, accessibility and the HTTP to HTTPS redirect probe can now report needing review instead. A page whose asset sizes never arrived is no longer called light, and an accessibility engine that failed to run is no longer indistinguishable from a clean result.
   • No score change A scan of a site not served over HTTPS no longer reports HSTS as enabled. The header cannot apply without TLS, so the check is set aside rather than passed.
   • Some scores fall A noindex directive is now found whatever order its attributes are written in, in every robots meta tag on the page rather than only the first, in the X-Robots-Tag response header, and in the content="none" form that means the same thing. Sites that were quietly deindexing themselves were previously reported as indexable.
   • Scores move both ways Server software disclosure is judged on what the header value actually says rather than on whether it contains a digit. Edge headers such as ECS (sjc/4E44) no longer count as a version, and an X-Powered-By header now counts as a disclosure even without a version number.
   • Some scores rise Viewport, canonical, Open Graph, favicon and lang declarations are now recognised whatever order, spacing or quoting their attributes use. Pages that were correct and were being marked as missing these tags now pass.
   • Some scores fall Requests that never received a response, from a DNS failure, a refused connection or a dropped certificate, are now counted. They were previously invisible to the failed-requests check, which reported no failures.