The scanner stopped guessing
A customer's report listed nine findings. Eight of them were not true.
Their site sits behind Cloudflare, Cloudflare answered our scanner instead of passing the request through, and every check we ran afterwards described what Cloudflare said rather than what their server would have said. Missing security headers that were in fact correctly set. An SSL certificate "expiring in 79 days" that renews itself automatically. An open port belonging to Cloudflare, not to them.
The one real finding, their email authentication, sat below four invented ones and never got read. That is the actual cost of a false positive, and it is why this release exists.
What changed
The scanner now knows whether it reached your server. This sounds obvious. It was not how the scanner worked. Reaching your origin is now established once, at the start, and every check that follows knows the answer. Nothing attributes a firewall's response to your website any more.
A section we could not measure is reported as not measured. Not as a bad score, not as a missing feature, and not silently. If your protection refused all three of our attempts, the report says so, tells you which sections were affected, and calculates your score from the rest.
Real DNS and email authentication checks. SPF, DMARC, DKIM and CAA records, checked properly rather than arriving incidentally from a vulnerability template. This matters more than it sounds: a DMARC policy of p=none publishes a record that looks like protection and enforces nothing, and it is the single most common way a small business gets impersonated to its own customers.
Cookie security attributes. Whether the cookies your site sets carry Secure, HttpOnly and SameSite, and what it means if they do not.
Every finding now tells you what to do about it. Specific instructions where we have them, and where we do not, the report says plainly that we do not have specific steps for that particular check rather than filling the space with generic advice.
A rewritten executive summary. It used to be a paragraph of prose that arrived a different shape in every report, which readers told us was hard to take in. It is now a fixed structure: the verdict, what is working, what needs attention with a severity on each, and one place to start. The same four things in the same order, every time.
Domain registration details are back. They had been blank for some time. The cause turned out to be a single missing request header that registries reject.
One thing that may surprise you
Some scores will move, and a few will go down.
If your site blocks our scanner, your score used to be calculated as though the headers section did not exist. That quietly meant a site we could not check at all could score higher than a site we checked and found imperfect. In the worst case it produced a perfect 100 for a site whose security headers we had never seen.
That is fixed. Unverified sections now earn nothing as well as deducting nothing, so a scan where we could not reach your origin is capped below 100 and your report shows you exactly which sections the score covers.
If your score dropped today, your website did not get worse. What changed is that we stopped awarding marks for things we had not checked. The number is lower and it is now supported by evidence. If you want the full number, the fix is to let us reach your origin, and your report tells you what blocked us.
We would rather explain this once than have you find it yourself.
Also in this release
Cookie information now appears in its own card. Registry and certificate dates are shown in UTC so they match what your registrar shows you, rather than shifting with the reader's timezone. A CAA check that did not complete says "not checked" instead of claiming no record exists. Email authentication severity now reflects whether your domain actually handles email. And the scan methodology section of every report has been corrected in four places where it described the scanner more generously than the scanner deserved, including an explicit statement of what our certificate check does not verify.
A note on what this release is. Almost none of it adds a new feature. It removes things the reports were saying that we could not support, and replaces them with either a correct answer or an honest "we could not check this". A security report is only worth the confidence you can place in it, and a reader who catches one wrong finding is right to doubt the rest.