Website Security Score

The Website Security Score is a dated snapshot of automated configuration checks. A high score is useful evidence about the observed setup, but it does not verify the organization behind a domain, its content, or every page.

The public /domain/{domain}/ report is the main entry point for domain information. It combines the Website Security Score and recommended fixes with DNS, currently resolving certificate hostnames, infrastructure, email posture, registration, and reputation data. Loading a domain report reads an existing scan but never starts a new website scan; when no result exists, the page offers an explicit Check website action.

Endpoints

POST /website-scans
GET /domain/{domain}/website-security
GET /website-leaderboard?view=top&limit=50&offset=0

All three API endpoints require an active workspace API key and any Suite or Lookups plan. Each request consumes one shared lookup unit. Saved ongoing monitoring separately requires Suite. See Authorization. The public checker returns current cached reports immediately and applies invisible abuse protection plus stricter anonymous limits to fresh scans.

curl "https://api.requestguard.com/v1/website-scans" \
  -H "Authorization: Bearer rg_sk_live_..." \
  -H "Content-Type: application/json" \
  --data '{"domain":"www.example.com"}'

RequestGuard normalizes a hostname or URL to its registrable apex, including IDNs and private suffix rules. A fresh scan returns 201. A scan served from the 24-hour cache returns 200 and sets _meta.cached to true. GET /domain/{domain}/website-security returns 404 SCAN_NOT_FOUND until a scan has been submitted.

Score model

website_security_v1 awards up to 100 points:

Category	Points	Checks
Secure connection	40	HTTPS response 15, valid certificate 10, HTTP-to-HTTPS redirect 5, TLS 1.2 or newer 5, HSTS for at least 180 days 5
Browser protections	30	Enforced CSP 10, frame protection 5, nosniff 5, safe referrer policy 5, restrictive permissions policy 5
Domain protection	15	DNSSEC 8, CAA 7
Known threats	15	Active-malware data 6, security-DNS result 5, domain blocklists 4

Short HSTS earns 2 of 5 points. A report-only or weak CSP earns 4 of 10. A partly restrictive permissions policy earns 3 of 5. A partly protective referrer policy earns 2 of 5. Each check returns pass, partial, fail, or unavailable, plus its point contribution and a recommendation when action is available.

If any weighted check is unavailable, the report has no numeric score and appears only in the New view. An active malware or security-DNS hit caps the final score at 39. A current domain-blocklist hit caps it at 59. Grades are A for 90–100, B for 80–89, C for 70–79, D for 60–69, and F below 60.

Header scoring is context-dependent. Read the evidence and recommendations rather than treating one header as a universal requirement; Mozilla Observatory explains the same limitation.

Email posture, domain age, popularity, IP country, provider, CISA KEV, and package vulnerabilities are not part of this score.

Search visibility signals

Fresh reports also include an unscored search-visibility panel. It checks whether an identified automated crawler can fetch the homepage, whether X-Robots-Tag or robots meta tags contain a Google noindex directive, whether robots.txt blocks the homepage, whether the canonical points at the same homepage, whether the initial HTML contains a title and visible content, and whether a sitemap can be discovered.

These checks can identify observable obstacles such as authentication responses, 429 or 5xx errors, JavaScript browser challenges, crawl rules, and conflicting canonicals. They do not query Google’s private index and cannot prove that a URL is indexed. Google’s exact crawl, canonical, and indexing decision is available only through URL Inspection for a verified Search Console property.

Scanner behavior and privacy

Manual submissions also start or reuse independent Public exposure checks. The optional public_exposure reference points to background progress. These checks have their own limits and never affect the security score.

The scanner resolves A and AAAA records before connecting and rejects localhost, private, reserved, link-local, multicast, or mixed public/private results. Connections are pinned to an approved address while preserving Host and SNI. Redirect destinations are resolved again, ports are limited to 80 and 443, and the scanner follows at most five redirects. It sends an identified RequestGuard scanner user agent, stops the scored security probes after response headers, and captures at most 128 KiB from separate homepage, robots.txt, and conventional sitemap probes. Per-step and 12-second total budgets still apply.

Complete reports are fresh for five minutes and can be served as marked stale data for up to 24 hours if a new probe fails. Incomplete reports are cached for no more than 30 seconds. Retained threat-source evidence can be used for up to seven days when a source is temporarily unavailable and is marked stale. Full reports are evictable cache entries; only the latest numeric score and the previous completed score are retained in D1. This feature does not create an account, ownership claim, alert, scheduled rescan, or monitoring service.

The public form retains a one-way hash for short-lived IP rate-limit counters; it does not store the submitter’s raw IP with the report. A domain can be suppressed from public output for abuse or legal handling.

Leaderboard

view accepts top, improved, or new. limit accepts 1 through 100 and offset must be non-negative. Top sorts by score, check time, then domain. Improved compares the latest completed score with the immediately previous completed score. New shows the most recently checked domains. Incomplete reports are cache-only and do not appear in these views.

Badges

Hosted badge URLs are:

https://requestguard.com/domain/example.com/badges/security.svg
https://requestguard.com/domain/example.com/badges/location.svg
https://requestguard.com/domain/example.com/badges/trust.svg

(The earlier https://requestguard.com/badges/example.com/security.svg form still works — it 301-redirects to the URL above.)

Append ?download=1 for a dated static SVG. The hosted SVG updates after a manual rescan and contacts RequestGuard whenever a visitor’s browser loads it. The downloaded file stays fixed and does not make that visitor request.

<a href="https://requestguard.com/domain/example.com/">
  <img src="https://requestguard.com/domain/example.com/badges/security.svg"
       alt="Website security score for example.com" width="184" height="44"
       loading="lazy" decoding="async" fetchpriority="low">
</a>

Use a badge only on the apex printed on it. The network-location badge uses the completed website scan: an ordinary server shows the resolved IP network country, while an anycast CDN or reverse proxy such as Cloudflare is labelled Global edge because its serving location varies by visitor and cannot be truthfully reduced to one country. It falls back to Unknown when the scan has no usable location evidence. The trust badge reads Trustworthy, Questionable, Not Safe, or Unverified based on the same score used elsewhere in the report, not a fixed claim.