Ocellus
Run a scan
ScanChecksMethodAbout

Catalogue

Every check, the question it asks, and what it weighs.

A scan runs 30 checks across 11 groups. Each check owns exactly one question about the target and answers it with a status, a headline and whatever evidence the source returned.

A check's weight is how much it contributes to the overall score. It takes one of three values. 1 is context: the check informs the report but a problem in it is not, on its own, a structural weakness. 2 is material: the check describes a control that changes the site's exposure in a real way. 3 is structural: the check covers a property that other protections depend on.

The score is the weighted mean of each check's status fraction over the checks that returned a verdict. The exact fractions, the treatment of unavailable results and the grade bands are on the method page.

Transport and certificates

3 checks

  • Certificate transparency

    What certificates have been issued for this domain, and for which hostnames?

    weight 2ct-logs

  • Certificate revocation

    Are any of the domain's issued certificates revoked?

    weight 2certificate-revocation

  • Redirect chain

    How many hops does the request take, and does any hop weaken the connection or change owner?

    weight 1redirects

Name system

6 checks

  • DNS records

    Which address, mail, name-server and text records does the zone publish?

    weight 1dns-records

  • DNSSEC

    Is the zone signed, and does the delegation from the parent resolve to a published key?

    weight 1dnssec

  • Domain registration

    When was the domain registered, when does it expire, and is it locked against transfer?

    weight 2whois

  • Zone hygiene

    Does the zone answer for names that do not exist, pin the protocol, and keep mail host records consistent?

    weight 1dns-hygiene

  • Aliases and service records

    Does the host alias another name, and does the zone publish service records that point somewhere unexpected?

    weight 2dns-aliases

  • Nameserver delegation

    Which servers actually answer for this zone, what network are they on, and is DNS hosted independently of the website?

    weight 2nameservers

Response headers

3 checks

  • HTTP security headers

    Which protective response headers are set, and are their values correct?

    weight 2security-headers

  • Edge protection

    Which CDN, web application firewall or reverse proxy sits in front of the origin?

    weight 1edge-protection

  • security.txt

    Does the site publish a current, valid security contact under RFC 9116?

    weight 1security-txt

Email

1 check

  • Email authentication

    Can this domain's mail be authenticated, and can anyone forge it?

    weight 2email-auth

Infrastructure

5 checks

  • Hosting and exposure

    Where is this hosted, who announces the address, and what is listening on it?

    weight 2infrastructure

  • Co-hosted domains

    Which other hostnames resolve to the same address, and does sharing that address tell you anything?

    weight 2cohosted

  • Exploited vulnerabilities

    Does the software named in the response appear in the catalogue of vulnerabilities known to be exploited?

    weight 3vulnerability-exposure

  • Subdomain surface

    Which hostnames under this domain are public, and does any of them look internal?

    weight 2subdomains

  • Technology stack

    What server, framework, CMS and third-party libraries can be identified from the response and the markup?

    weight 2tech-stack

Privacy

1 check

  • Cookies and trackers

    What does this page set and load before a visitor has agreed to anything?

    weight 2privacy

Content and accessibility

1 check

  • Markup and accessibility

    Is the document structured correctly for people and for assistive technology?

    weight 2markup

Performance

2 checks

  • Page weight and loading

    What does the document ask the browser to download before it can paint, and what do the headers say about delivery?

    weight 2performance

  • Energy estimate

    How much energy and carbon does one page view cost, by a published model?

    weight 1carbon

Search and preview

1 check

  • SEO and crawlability

    Can search engines crawl, index and correctly preview this site?

    weight 2seo

Reputation

6 checks

  • Threat reputation

    Does public threat intelligence associate this domain with known malicious activity?

    weight 2threat-intel

  • Malware and phishing listings

    Is this site currently listed by any public malware, phishing or compromise feed?

    weight 3malware-listings

  • Filtering resolvers

    Do resolvers that filter malware and phishing refuse to answer for this domain?

    weight 2blocklist

  • Operator breach history

    Has the organisation behind this domain appeared in a publicly disclosed data breach?

    weight 1breach-history

  • Archive history

    How far back does the public archive reach for this site?

    weight 1archive-history

  • Popularity rank

    Where does this domain sit in a public traffic ranking?

    weight 1popularity

Interface friction

1 check

  • Interface friction

    Does the page use pre-ticked consent, guilt-based refusal copy, hidden exits or urgency pressure?

    weight 2dark-patterns

Weight in one place

Every check in the registry falls into one of three weights. The counts are printed from the registry itself, so they cannot disagree with the scan.

  • 32 checks

    structural

  • 218 checks

    material

  • 110 checks

    context