Trust at a glance
A composite trust score from real captured signals, HTTPS, headers and configuration, so you see risk before it costs you.
Site Trust & Security
A bounded scorecard for captured site trust signals, headers and supported external probes.
Site Trust & Security scores your site's HTTP trust signals and security headers from a real crawl, and runs an automated pentest for exposed database ports and leaked backup files.
Automated pentest (exposed ports & backup leaks) on Pro+
Why it is useful
A clear decision, with the supporting evidence close by
Most security tools either overwhelm you with raw scanner noise or quietly guess at gaps they never actually measured, and both leave you unable to say which findings are real. You need a trust picture built only from what your site truly exposes to any visitor, with a clear, specific fix attached to every finding.
Automated pentest
Detect exposed database ports and leaked backup files (.sql dumps, .env, .git) that quietly leak your data.
Header coverage
HSTS, CSP and X-Frame-Options coverage graded, with the exact fix for each gap.
Data and evidence
See the evidence behind each result
Site Trust reads what your own pages return: HTTPS coverage across every crawled URL, whether HTTP redirects to HTTPS, the six security response headers with CSP strength graded, and mixed content on secure pages. An exposure scan that could affect a live host runs only after domain ownership is verified.
Primary input
Crawl plus verified-domain probes
Product layer
Weighted trust criteria
Primary output
Evidence-linked security queue
How to read this result
Exposure scanning runs only for verified domains; a reachable path is a review finding, not proof that sensitive data was disclosed.
Core capabilities
What you can do with Site Trust & Security
You get a weighted trust score built from measured factors, a per-header scorecard that names which header is missing or weak on which pages, mixed-content findings resolved to URLs, and an ownership-gated exposure scan for the checks that need permission before they are run.
01
Weighted site trust score
A single 0-100 trust score is computed across every crawled HTML page from four weighted factors: HTTPS coverage, security-header strength, freedom from mixed content, and Cache-Control hygiene. When there are no crawled pages to observe, the score is reported as insufficient rather than a fabricated zero. Each factor shows its own coverage percentage and the exact page counts behind it.
- HTTPS coverage weighted at 40%
- HTTP to HTTPS redirect enforcement
- Mixed-content pages loading http:// subresources
- Cache-Control header coverage
02
Per-header security scorecard
Coverage is scored for the six standard response headers: Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. CSP is credited by policy strength, so a real default-src/script-src policy earns full credit while an upgrade-insecure-requests-only header is flagged as weak. A header stored as empty means the site genuinely never sent it, which is treated as a true missing finding, not a capture gap.
- CSP scored by policy strength
- HSTS, X-Frame-Options, nosniff coverage
- Referrer-Policy and Permissions-Policy
- Per-page missing-header counts
03
Ownership-gated exposure scan
For a domain you have verified you own, an active scan probes for exposed files, checks the live TLS certificate, and detects publicly open ports. It looks for leaks such as .env, .git/config, database dumps and config backups, reads the certificate issuer and days-to-expiry, and flags disclosed server banners or X-Powered-By values. For anyone else the domain stays unverified, so these signals read as not checked and never dock the score with a failure that was never measured.
- Exposed .env, .git and backup-file probes
- Live TLS validity, issuer and expiry
- Open-port detection (FTP, Telnet, database, Redis)
- Server banner and X-Powered-By disclosure
How the work moves
From available evidence to a reviewable next action
Crawl the site, let the factors be scored, verify ownership when you want the deeper scan, then fix each finding against the page it came from. The score is recomputed from the next crawl, so a fix is confirmed by measurement instead of being assumed once the change is deployed.
- 01
Crawl the site
Every HTML page's HTTPS status, response headers and mixed-content signals are captured during the crawl.
- 02
Score the factors
HTTPS coverage, header strength, mixed content and cache hygiene are combined into one weighted trust score.
- 03
Verify ownership
For a domain you have verified, an active scan adds live TLS, open-port and exposed-file checks.
- 04
Fix each finding
Every issue arrives as an atom with evidence and a copy-ready server-config fix.
Built around real work
Useful for teams who need to move from evidence to delivery
Site owner
Get one honest trust score and a prioritized list of the exact headers and exposures to fix first.
Agency or consultant
Run a repeatable HTTP-level security audit on a client site and hand over evidence-backed remediation steps.
Developer
Confirm that HTTPS is enforced, security headers are set, and no config or backup files are publicly reachable before launch.
Connected outcomes
Continue from this product into a complete customer workflow
Resources
Read more about Site Trust & Security
Written by the team that built it, and free to read without an account.
Guides
Step-by-step walkthroughs, five minutes each.
Definitions
What the terms on this page actually mean.
Try it free
Run the idea on a real URL, no account needed.
Connected products
Keep the work moving without losing the source
Frequently asked questions
Site Trust & Security FAQ
Clear answers about data, availability and how the product fits into the wider workflow.
Do you access my server over SSH?
No. All checks are HTTP-level and network-level; the scan detects publicly open ports but never logs in or touches the filesystem.
Why is a header shown as missing when I think I set it?
The scorecard reads the value actually captured on each page; an empty value means that page did not send the header in its response.
What happens if a certificate probe times out?
It is reported as not checked, not as an invalid certificate, so a connection we could not complete never fabricates a failure.
Why can't I see the active exposure scan?
The exposed-file, TLS and port scan only runs once you have verified ownership of the domain, which keeps active probing to sites you control.
Trust & Experience
Put Site Trust & Security to work on your own evidence.
Start with a real project, keep unavailable data visible and follow the connected workflow when the result is ready for action.