Required gates
HTTPS must return a successful response; TLS must be trusted with matching hostname, modern protocol, and at least fourteen days left; HTTP must redirect to HTTPS. These are prerequisite checks for publication.
Evidence
What the scanner actually checks
Passive, unauthenticated observations with timestamps and raw evidence.
Verified checks, owner statements, and community opinions have distinct assurance levels. Preserve those labels in every integration.
Security headers
HSTS checks its max-age. CSP is assessed for baseline restrictions and unsafe directives. MIME sniffing, framing protection, and referrer policy are examined separately. These checks are not a penetration test.
Policy and transparency presence
Privacy and terms links are discovered from the homepage, then checked for readable relevant content. Consent signals are heuristic. security.txt must contain a contact and future expiry; llms.txt needs an H1.
Protocol and PWA observations
The HTTPS evidence records Alt-Svc h3 advertisements, a manifest reference, and a service-worker registration reference. These are informational signals. The Node scanner does not negotiate QUIC or prove browser installability.
Limits
DNS is resolved and public addresses pinned; redirects are rechecked. Responses have a size cap, scan requests have a budget, and robots exclusions are honored for extra paths. Manual scans are available every ten minutes.
result: pass | warning | fail | not_checked assurance: verified | not_verified | illustrative
