What a free check can and cannot tell you
A public check reads what your site already publishes: the protocol it negotiates, the headers it returns, the records in your DNS, the pages a crawler can reach. It is a genuine measurement of that surface, and it is the surface most small-business incidents start on. What it cannot do is see inside your application, so it cannot tell you your site is safe. No automated scan can.
- It reads configuration, not code
- It observes without logging in
- A clean result means no public signal failed, not that no vulnerability exists
- It does not replace a professional security assessment
The five categories, and why they are weighted the way they are
HTTPS and TLS carries the most weight because a failure there affects every visitor on every page. Security headers and email domain security follow, because both are cheap to fix and expensive to ignore. DNS hygiene carries the least, not because it does not matter, but because a gap there is usually hardening rather than exposure. The weights are a product decision and the full method is published.
What happens to your results
The report opens at a private address with a random token, expires after 48 hours, and is never indexed. Raw scanner output is processed in memory and deleted within minutes. Serious findings on a domain nobody has proven they own are classified and dropped before anything is written to a database.