Scan Categories
Every FlawPilot scan grades your site across four categories. Each category gets
its own score, weighted by risk - a missing Content-Security-Policy costs more
than a missing Referrer-Policy, because the risk isn't equivalent.
| Category | What it covers |
|---|---|
| Security | Headers, TLS, DNS/email auth, and vulnerability signals |
| Performance | Core Web Vitals, loading speed, and caching posture |
| Infrastructure | Ports, subdomains, cloud storage, and edge protection |
| SEO | Metadata, crawlability, structured data, and link hygiene |
How scoring works
Most checks are binary - they pass or fail against explicit criteria. HSTS,
for example, passes only at max-age ≥ 15552000 (180 days); a shorter lifetime is
a failure, not a partial pass.
Performance is the exception: its metrics award partial credit on a sliding scale, because a 3-second LCP is meaningfully better than a 6-second one even though neither is good.
Multi-page sampling
Performance and SEO are measured across 4–5 representative pages rather than the homepage alone. For SEO, every sampled page must pass for full marks - so a polished homepage can't compensate for a neglected template.
Scoping a scan
You can run all four categories or narrow the scan to the ones you care about. Narrowing is useful when you're iterating on a single fix - a Security-only rescan returns faster than a full scan, because performance measurement across multiple pages is the slowest stage.
Risk bands
The overall result is summarised as one of four bands:
| Band | Meaning |
|---|---|
| Production Ready | No material issues found across the scanned categories. |
| Growth Ready | Fundamentals are sound; remaining findings are improvements rather than risks. |
| Elevated Risk | Findings that should be addressed before or shortly after launch. |
| Critical Risk | At least one finding that warrants immediate action. |
The band reflects the severity of what was found, not just the arithmetic score. A single critical finding — a live API key in a JavaScript bundle, say — places a site in Critical Risk even when the numeric score is otherwise high.
Finding severities
Individual findings are labelled by severity:
- Critical — exploitable or already-exposed. Act now.
- High — a significant gap in your public defences.
- Medium — a real weakness with limited immediate impact.
- Low — hardening and hygiene.
- Info — context, not a defect.
Each finding states what was observed, why it matters, and how to verify the fix
yourself — for header checks, typically a curl -I against your own URL.
Limits of a public scan
FlawPilot grades what your site exposes publicly. That view is genuinely useful — it's the same view an attacker or a crawler has — but it is not exhaustive:
- Authenticated areas, internal services, and admin panels are not scanned.
- Application logic flaws (broken access control, injection) require testing that goes beyond passive observation.
- A Production Ready band means nothing was found in the checked categories. It is not a certification that your site is secure.