All security checks

The certificate is the foundation of the connection: if it is missing, expired or untrusted, every other protection is moot — traffic can be intercepted. Hence the heaviest weights (−10); "expiring soon" is softer because it is a warning, not yet a failure.

Headers are the cheapest protection on the web: one server setting blocks whole classes of attack. HSTS weighs most (−10) because without it even the first visit can be hijacked. CSP (−8) guards against injected code. The rest scale down by how much real damage the absence causes.

Outdated software is the most common cause of real breaches — the flaws are publicly documented and the tooling is automated. A plugin with a known CVE carries the heaviest weight in the whole system (−12): that is not a theoretical risk but a working attack path.

If the domain or server IP is already flagged as phishing or malicious, that is no longer a risk but a fact — browsers and mail systems start blocking. Hence −10. Important distinction: a block by CONTENT filters (family, ads) costs nothing, because that is the filter's categorisation choice, not a flaw in your site.

DNS is the address directory: if it can be forged, visitors land somewhere else even with the correct address. DNSSEC (−5) is mid-weight because such attacks take effort. Domain age is shown to everyone but only penalises very new domains (−4), which are disproportionately used for fraud.

Without these records anyone can send mail in your name — to clients, partners, accounting. It is one of the most real threats to small business, so missing fundamentals weigh −6…−8. An overly permissive SPF (+all) is punished harder (−8) than a missing one: it actively authorises impersonation.

This looks for files and panels left online that open a direct path in: .env with passwords, .git with the whole codebase, database backups, phpMyAdmin. Finding one is not a risk but an open door — hence critical weights (−10). The whole group is capped at −30 combined so a single false positive cannot zero the score.

These findings mean foreign code is most likely already running on the site: a crypto-miner, a hidden iframe, or a password form posting to another domain. They are signs of compromise, not configuration gaps — hence −10. An independent urlscan.io verdict is treated just as strictly.

These are not breach risks, so the weights are small. Trackers without consent (−3) are a GDPR-compliance matter rather than a security one. Sitemap and indexing are included because they decide whether customers find you at all — but they never weigh as much as a real vulnerability.