Methodology changelog

Our grades only mean something if you can see how they are made and when that changed. A change that moves grades gets a new version number; a check added without grade impact is listed under the version in force. Each tool page shows the version of every result.

1. 2026-11-14 · Security Headers · v1.1

   Grade v1.1, after checking v1.0 against the 1,000 most visited sites (636 could be graded). Corrections; the grade bands are unchanged. Each weakness is now charged once: a policy that allows inline script or a script wildcard, a Report-Only policy, HSTS with a short max-age, HSTS of a year or more without includeSubDomains, and a Permissions-Policy that does not parse already earn fewer coverage points, and no longer lose effectiveness points as well (a weak policy could score below no policy). HSTS under a year without includeSubDomains keeps its deduction, because there the coverage points do not tell the two apart. A missing Referrer-Policy is not counted, because browsers apply strict-origin-when-cross-origin by themselves. "Hosts with known bypasses" is reported only when the policy lists a host with a known bypass (it was also raised for hosts with none). Reporting endpoints and Subresource Integrity are still checked and shown, and no longer graded. Cookie deductions keep the three real exposures (a session cookie without Secure or without HttpOnly, SameSite=None without Secure); other flag gaps count through the coverage share. A header never costs more than leaving it out. Worked out from the stored results of the 636 sites, these rules move 149 of them up a letter and none down.

2. 2026-11-13 · SSL Certificate · v1.1

   Grade v1.1: a revoked certificate (OCSP, or the CRL when the certificate names no responder) grades F. The distrust radar matches roots by their key, dates a certificate by its first Certificate Transparency log entry, and no longer mistakes IdenTrust for Entrust. Added, without grade impact: Extended Key Usage (no serverAuth; clientAuth ending in June 2026), the validation level (DV, OV, EV), embedded SCTs, Must-Staple without stapling, a rebuilt chain to download when intermediates are missing, the certificate on every other address of the name and without SNI, CAA against the current issuer, and broken DNSSEC (which stops renewals since SC-085).

3. 2026-11-13 · Security Headers · v1.0

   Added, without grade impact: a CORS check that sends a made-up Origin and reports a server that echoes it (high when it also allows credentials) or forgets Vary: Origin.

4. 2026-11-13 · Response Time · v1.0

   Reported beside the cold median, never inside it: 103 Early Hints, two warm requests on a reused connection, TLS session resumption, and one request over HTTP/2 (with a warning when HTTP/2 answers differently).

5. 2026-11-13 · Down · v1.0

   The name is also asked of three public resolvers (Cloudflare, Google, AdGuard DNS): broken DNSSEC, a name some resolvers cannot find, and resolvers that disagree are reported.

6. 2026-11-13 · All tools · probe 0.2.0

   The probe reads the certificate's extensions (EKU, policies, SCTs, Must-Staple), checks revocation, rebuilds an incomplete chain from the CA Issuers links, connects to a chosen address or without SNI, records 1xx responses, measures warm requests and resumption, and can fetch over HTTP/2.

7. 2026-11-13 · Security Headers · v1.0

   Added, without grade impact: security.txt (RFC 9116); mixed content in frames, objects, images, media and forms; Permissions-Policy checked against the features the page and its embeds use; cookie Domain breadth with the public suffix list; Integrity-Policy, Document-Policy and Origin-Agent-Cluster; cross-origin isolation (COOP with COEP). Fixes for 32 platforms with a "will this break anything?" note on each.

8. 2026-11-13 · SSL Certificate · v1.0

   Added, without grade impact: mixed content on the landing page; a business-owner view of the result; certificate fixes for IIS, cPanel, Plesk, AWS (ACM on ALB and CloudFront), Azure, Caddy, Traefik, Kubernetes (cert-manager) and Node.

9. 2026-11-13 · Down · v1.0

   A new state, Can't check: an IPv6-only site our probe cannot reach (it has no IPv6 route yet) is no longer reported as Down. Error-code explainer pages.

10. 2026-11-13 · Response Time · v1.0

    CSV download of the samples and the waterfall; a glossary of the measurements.

11. 2026-11-13 · All tools · probe 0.2.0

    The scanner sends cookies a site sets on one redirect hop back on the next, as a browser does; each tool adds its own User-Agent token beside BCDRPulseHeaders; text decoding follows the browser's charset order; zstd responses are decoded; scans can run as a desktop or a mobile browser; site owners can ask not to be checked.

12. 2026-11-12 · Security Headers · v1.0

    First version: two axes (coverage of effective protections, effectiveness after deductions), letter from the lower of the two, browser-truth rules (ignored headers score as absent), CSP analysed with Google's CSP Evaluator.

13. 2026-11-12 · SSL Certificate · v1.0

    First version: gates F, T and M as in SSL Labs, lifecycle and renewal health against the CA/Browser Forum SC-081 lifetimes, the distrust radar, HSTS and the HTTP redirect.

14. 2026-11-12 · Response Time · v1.0

    First version: three sequential cold samples, the median, phase waterfall, server-time estimate, CDN detection, published TTFB and server-time bands.

15. 2026-11-12 · Down · v1.0

    First version: Up, Gated, Error and Down, layer by layer, with retries on the www and http/https forms of the address.

The tools: Security Headers, SSL Certificate, Response Time, Down.