Grade A: 90 points and above
Your website, graded A to F.
Paste an address. We read its headers, certificate, DNS and cookies, then write down what to change.
Passive analysis: GET and HEAD requests, nothing else.
Grade B: 80 to 89 points
Recompute a grade.
Tick what a site is missing. The arithmetic is the one our reports use, down to a tenth of a point.
The two caps and the full arithmetic are in the scale.
Result
Grade B, 80 out of 100.
Grade C: 70 to 79 points
Six families, a hundred points.
Every scan starts at 100. A finding takes a share of its family's weight: 40% if it is high, 20% if medium, 8% if low.
Security headers30 points
Content-Security-Policy parsed directive by directive, HSTS, nosniff, framing protection, Referrer-Policy, Permissions-Policy, chatty headers.
TLS and certificate20 points
HTTPS availability, working redirection, certificate expiry, name coverage, complete chain, accepted protocol versions.
DNS and email20 points
SPF and its lookup limit, DMARC and its policy, DKIM, DNSSEC, CAA, presence of MX.
Exposure15 points
Well-known public paths: .env, .git, backups, phpinfo, directory listing, security.txt.
Cookies10 points
Secure, HttpOnly, SameSite, domain scope — with particular attention to cookies that look like a session.
Page content5 points
Mixed content, target="_blank" links without noopener, cleartext forms, third-party scripts without SRI, revealing comments.
Grade D: 55 to 69 points
Only GET and HEAD.
- 40 requests at most
- one per second to the same domain
- ten seconds to a minute
No injection, no fuzzing, no brute force, no authentication attempts, no load testing. Nothing that changes the state of the site being analysed: that is what makes it possible to analyse any public address, as SSL Labs or Mozilla Observatory do.
Grade E: 40 to 54 points
We don't guess.
Passive analysis observes headers and records: it does not prove a vulnerability. When a check cannot conclude, the report says “undetermined”, not “missing”. And every finding carries the observed evidence, next to the exact line to change.
Every report can be published at a short URL, readable without an account — handy for sending to the host or contractor who has to fix it.
No Strict-Transport-Security
Security headers · high · −12 points
Observed evidence
{
"strict-transport-security": null
}To change
Serve Strict-Transport-Security: max-age=63072000; includeSubDomains. Without HSTS, the very first visit happens in clear text and can be hijacked before the redirect to HTTPS even happens.
Reports are written in French for now.
Grade F: below 40 points
And if it's an F?
Every finding says what to change. Fix it, then scan again: one credit, given back if the analysis fails.
€1 per credit, or a subscription from €9 a month.
Stuck somewhere? Write to us.
Scan, account, payment or exclusion request: pick a topic and we'll reply by email.
Before you write
My scan failed. Did I lose a credit?
No. A failed scan gives its credit back automatically — you'll see it in the history on the Account page. Run it again: if it fails again on the same site, write to us from the scan page and its reference will be attached.
I didn't get the confirmation email.
Check your spam folder: it comes from an automated sending address. Still nothing after a few minutes? Write to us with the address you used and we'll check the account.
I paid, but my credits don't show up.
Credits are added once Stripe confirms the payment, usually within seconds. Refresh the Account page. If a few minutes go by, write to us with the “Payment” topic and we'll track down the transaction.
How do I exclude my site from the scanner?
Pick the “Exclusion” topic and write from an address on the domain in question: that is how we check the request really comes from the site owner.
Write to us
Pick a topic: the right context saves a round trip.