From a bare domain to a full trust report.
Every scan follows the same disciplined pipeline. Each check is isolated, so a single slow or failing lookup can never break the whole report.
Normalize
We strip the scheme, www. and path down to the bare domain, and reuse a recent report if
one was generated in the last 7 days.
Inspect
Independent checks run across DNS, WHOIS/RDAP, SSL, HTTP, page content and technology — each wrapped so one failure is isolated from the rest.
Score
Every result becomes a trust signal with a clear status. The signals are weighed together into a single 1–100 score across five bands.
Cache & share
The report is stored at a permanent, shareable URL and served instantly to the next visitor until it's older than 7 days.
What runs on every scan
Each stage produces structured signals — never raw, unexplained data.
Domain & DNS
WHOIS/RDAP registration data — age, registrar, status, expiry and abuse contact — plus nameservers, DNSSEC status and the resolved hosting location from the domain's IP.
Transport security
A live TLS check reads certificate validity, issuer and expiry, and confirms whether insecure traffic is redirected to HTTPS.
Threats & content
Google Safe Browsing for malware and phishing listings, plus a content-safety pass and a read of the homepage for essential pages, metadata and social presence.
Reputation & technology
Domain authority from the backlink profile, and the CMS, server, CDN, analytics and other technologies fingerprinted from the site's HTML and headers.
A failing source degrades the report — it never breaks it.
Every external lookup is isolated. If a provider is unreachable, that one signal is marked as "not checked" and the rest of the report is produced as normal.