Every check is passive and read-only. We make the same kind of requests a normal browser makes. We never log in, guess passwords, exploit anything, or change anything on your site. Please scan only sites you own or manage.
Your site should use an encrypted connection that's set up correctly, so visitors' data stays private.
Settings that help browsers block common attacks on your visitors.
Outdated server software is a common way in.
Common WordPress settings that reveal more than they should.
Setup and configuration files left reachable can expose private details.
Keys left in page code could open access to your data.
Stops others from sending email that pretends to be from your domain.
Your score is a plain guide to how your public basics look. Things we can't confirm from outside don't lower it. It's a guide, not a guarantee.