Check-set v1.0
The 61 checks behind every report.
This list is the product spec. The free check runs 14 of 61 checks; reports and certificates name the check-set version they used, so a result can always be traced to the exact list. Any change to the list bumps the version.
Version
v1.0
Free check
14 of 61 checks
All 14 are marked below.
Machine-readable
/checks.json has the same list, and /llms.txt points to it.
Safe Profile default throughout; T3+ gated by per-asset opt-in. The free check shows the free items as titles with severity, plus a score; evidence and fixes are in the paid reports.
Group A · T0 passive
DNS & identity
12 checks. All paid reports. Items marked Free also run on the free check.
- 1SPF record presentFree
- 2SPF lookup-count ≤10Free
- 3SPF syntax valid
- 4DKIM selectors live
- 5DMARC policy presentFree
- 6DMARC policy strength (p=reject/quarantine/none)Free
- 7DMARC rua/ruf reporting
- 8MX hosts resolve
- 9DNSSEC status
- 10CAA records present
- 11Subdomain CNAME targets unclaimed (takeover CANDIDATES — report only, never claim)
- 12DNS vs web host mismatch map (who actually controls what)
Group B · T1
Certificates & TLS
9 checks. All paid reports. Items marked Free also run on the free check.
- 13Cert valid + expiry windowFree
- 14Issuer/chain completeness
- 15Protocol versions (TLS 1.2+ only)
- 16Weak cipher suites
- 17Certificate transparency log coverage
- 18Mixed-content presenceFree
- 19HSTS present + preload eligibilityFree
- 20Revocation endpoints reachable
- 21www/apex + common SAN coverage
Group C · T1
HTTP headers & cookies
8 checks. All paid reports. Items marked Free also run on the free check.
- 22CSP present/strictnessFree
- 23X-Content-Type-Options
- 24X-Frame-Options / frame-ancestors
- 25Referrer-Policy
- 26Permissions-Policy
- 27Cookie flags (Secure/HttpOnly/SameSite)Free
- 28Server banner leakage
- 29Redirect chain hygiene (http→https, canonical)Free
Group D · T1 crawl
Content & leakage crawl
10 checks. All paid reports. Crawl depth: ~12 pages on the free check, 75 on Site Report, 250 on Complete.
- 30Emails exposed on pageFree
- 31Filepath leakage
- 32.git/.env/.bak exposureFree
- 33Backup/archive file exposure
- 34Directory listing on
- 35robots.txt disclosed admin paths
- 36Sitemap exposure of staging/dev hosts
- 37Comments/forms leaking PII
- 38Error-page stack traces
- 39Third-party script inventory (count + known-sketchy list)Free
Group E · T2/T3
Fingerprint
7 checks. Site Report and Complete. T3 fingerprinting runs only with your per-asset opt-in.
- 40CMS detection + version
- 41Known-CMS version vs advisory feeds
- 42Plugin/theme enumeration (WP)
- 43Server/software version disclosure
- 44Open ports map (rate-limited Safe Profile)
- 45Service banners on open ports
- 46Default pages / default credentials pages
Group F · Complete
E-commerce & third-party
6 checks. Complete.
- 47Checkout third-party scripts (card-data proximity)
- 48Known Magecart-class skimming patterns
- 49Payment page header/iframe hygiene
- 50Cookie consent vs actual scripts
- 51CDN/WAF presence + misconfig tells
- 52Webhook/return-URL exposure
Group G · Complete
AI surface
6 checks. Complete. Item 58 also runs on the free check, as a presence check only.
- 53AI/chatbot endpoint inventory (AIMAP-style)
- 54Endpoint vs expected auth controls
- 55llms.txt/agent files present + consistent
- 56Model-API key leakage in JS
- 57Prompt-injection posture of public chat (firewall presence)
- 58Agent/MCP endpoints exposed unauthenticatedFree: presence only
Group H · Reports
Posture & reports
3 checks. Paid reports.
- 59Blocklist/reputation status (cited + linked, never reproduced — vendor-licence rule)
- 60Breach-exposure summary (HIBP-domain class, only with verified control)
- 61Point-in-time attestation record (scan hash, scope, limitations)
Want the detail behind a result? Every paid report shows the proof, the fix and an effort estimate for each finding. See the report format.