Version 2.1: Static Security Audit in Every Report

A fourth score: website security

We have released scoring version 2.1. Every fresh audit now includes a fourth branch: a passive Security audit, evaluated on the same crawl as your SEO, GEO and WCAG results. The combined visibility score is now the average of all four branches.

Your report gains a Security score card with a letter grade, a per-category breakdown and prioritized fixes — right next to the pillars you already know.

What the Security branch checks

The audit is organized into four weighted categories:

• Transport (30%) — HTTPS usage, HTTP → HTTPS redirect, HSTS (max-age, includeSubDomains, preload) and mixed-content references.
• Headers (30%) — Content-Security-Policy (and common weaknesses such as unsafe-inline or wildcard sources), X-Frame-Options / frame-ancestors, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP/COEP/CORP and permissive CORS.
• Content (25%) — forms posting over HTTP, tabnabbing (target="_blank" without rel="noopener"), iframes without sandbox, external scripts without Subresource Integrity, risky inline handlers and javascript: URIs, potential secrets in markup and outdated JavaScript libraries.
• Exposure (15%) — cookie flags (Secure, HttpOnly, SameSite), server and framework version disclosure, sensitive paths in robots.txt, a published security.txt and accidentally exposed files.

Passive by design

Like our other branches, the Security audit is static and passive. We inspect response headers, the returned HTML and a few read-only probes (an HTTP → HTTPS redirect check, /.well-known/security.txt and common exposed-file paths). We never inject payloads, brute-force anything or perform active penetration testing, and requests to private, localhost and cloud-metadata addresses are rejected.

This means the audit surfaces configuration and hardening gaps quickly and at scale, but it is not a substitute for a full penetration test.

What you will see in the report

• A Security score card with letter grade and 0–100 score.
• Per-category scores for Transport, Headers, Content and Exposure.
• Security issues mixed into the prioritized recommendation list, tagged by severity.
• Security metrics tables in the HTML report and the PDF export.

Re-run your audit

Reports from version 2.0 or older remain valid for SEO, GEO and WCAG, but they do not include the Security branch. Generate a fresh report to see your security score on the same crawl.

See the methodology page for the full list of security checks and how the branch is scored, or browse the scoring changelog.