There's a reason most website scanners don't publish this list: it invites scrutiny. A vague promise of "comprehensive security scanning" is much easier to sell than an itemised account of exactly what you do and don't look at.
We'd rather be scrutinised. If you're going to trust a report about your own business, you should be able to see precisely what produced it, before you pay for anything. Every check below runs against your live website. If a check can't complete, we tell you it wasn't tested. We never fill a gap with a plausible guess.
Security
The things an attacker would look for, and the configuration mistakes that quietly leave the door open.
SSL certificate & HTTPS
Whether your site is served over a valid encrypted connection. Without it, anything a customer types travels in the clear and browsers label you "Not secure".
Security headers
Five browser-level protections (HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy) that defend visitors against clickjacking and code injection.
SPF record
Whether you've declared who is allowed to send email as your business. Without it, anyone can.
DKIM signing
Whether your outgoing email is cryptographically signed, so recipients can verify it genuinely came from you.
DMARC record and enforcement level
Whether you have a policy telling receivers what to do with spoofed mail, and critically, whether it's actually enforced or merely monitoring.
Duplicate SPF / DMARC records
The misconfiguration almost nobody checks. Publish two DMARC records and receivers ignore DMARC entirely, so you look protected while anyone can spoof you. We've found this on live Australian businesses that believed they were covered.
Malware & phishing blacklist
Whether Google has flagged your site as unsafe. If it has, most visitors never get past the red warning screen.
Known software vulnerabilities
WordPress core, plugins and themes checked against a live vulnerability feed. Out-of-date components are the single most common way small-business sites get hacked.
Payment handling
Whether your checkout uses a recognised hosted payment provider, keeping card data off your own servers and reducing your PCI burden.
Domain registration expiry : not possible for .au
When your domain lapses. An expired domain takes your website and your email offline, and can be bought by someone else.
The honest catch: we cannot perform this check on a .au domain, and neither can anyone else. Under auDA's WHOIS Policy (clause 4.5) expiry and renewal dates are deliberately withheld from the .au registry, scrapers were harvesting them to send registrants fake renewal notices. Since almost every site we scan is a .au domain, this check will usually come back as "not tested", and we'll show you how to check it yourself in about two minutes. We'd rather tell you that here than let you find out after you've paid.
Registrar transfer lock
A free setting that stops your domain being transferred away after a credential leak, one of the most common hijacking routes.
DNSSEC
Whether your DNS answers are cryptographically signed, so attackers can't forge them and silently redirect your visitors or your mail.
Privacy
This is where we stop counting records and start reading.
Privacy policy: present
Whether you have one at all. For any business collecting personal information, it's a direct legal requirement.
Privacy policy,depth
We open your actual policy and check it against the five elements the Australian Privacy Principles expect: what you collect, whether it goes to third parties or overseas, how it's stored, how someone makes a complaint, and a last-updated date. We name the ones that are missing. Almost nothing else on the market does this.
Cookie-consent notice
Whether visitors are told about tracking before it happens.
Analytics & tracking detection
Which advertising and analytics tools are actually running on your site: named, not just counted.
Region-aware consent requirements
If you tell us you have EU or UK customers, we apply their rules: non-essential cookies must not load until the visitor actively opts in. Australian businesses selling overseas routinely miss this.
Customer accounts & login credentials
Whether your site lets customers create an account and sign in. Holding logins is normal and is not a fault, but it changes what a breach means, because people reuse passwords. We explain what the Notifiable Data Breaches scheme then asks of you.
Australian consumer law & business identity
Terms & Conditions
Whether you've published the contract that governs every sale you make.
Returns & refund policy: present
What the Australian Consumer Law expects when you sell goods or services.
Refund wording: read against the ACL
We read your terms and refund pages for blanket "no refunds" and "all sales are final" statements. Consumer guarantees can't be excluded, so these can be unlawful: and the ACCC actively enforces against them. We flag the exact wording for professional review. We never make a legal determination. An automated scan doesn't get to do that.
Shipping / delivery policy
For online stores: whether customers can see delivery times, costs and areas served before they buy.
ABN / business identity
Whether customers and B2B partners can verify you're a real registered business.
Business address visible
A basic transparency signal. Its absence raises legitimacy questions and costs conversions.
Contact details reachable
Whether there is any visible way to reach you, contact page, phone, or email.
Marketing consent quality (Spam Act)
Whether your sign-up boxes are pre-ticked. Under the Spam Act, consent must be an active choice, a pre-ticked box isn't valid consent, which can make your whole marketing list unlawfully collected.
Performance & experience
Broken links
We crawl your pages and test the links. Every broken one is a dead end for a customer, and a signal to Google that the site isn't maintained.
Mobile-friendliness
Whether your pages are built to display properly on a phone, where most of your traffic actually is.
Content freshness
Whether your site looks current or is quietly showing its age, an out-of-date copyright year, or old events still listed as upcoming. A brand-and-trust signal, not a fault; shown for your awareness.
Placeholder & template content
Whether your site still carries a website builder’s defaults (unrenamed template pages (like /about-harris or /new-page-2), or placeholder text and headings (“Lorem ipsum”, “XXXX”)) which read to a visitor as “half-built” and quietly cost you credibility.
AI Readiness
Six on-page signals showing how ready your site is for AI assistants (ChatGPT, Perplexity, Google’s AI answers) to discover and understand your business. Informational. It does not affect your TrustScore.
AI crawler access
Whether your robots.txt allows the AI crawlers (GPTBot, ClaudeBot, Google-Extended, PerplexityBot) to read your site. Blocking them is a legitimate choice, we report it neutrally, never as a fault.
Readable without JavaScript
Most AI crawlers do not run JavaScript, so a site built entirely in the browser is invisible to them. We check whether your content is in the initial HTML.
Structured data (Schema.org)
The machine-readable summary AI assistants and search engines use to understand your business correctly, instead of guessing from your page text.
Machine-readable business identity
Whether your name, contact details and identifiers are present in a form an AI can extract and cross-check.
Preview & summary metadata
Meta description and Open Graph tags, the short summary AI and social platforms use to represent your page.
Agent-navigability
Whether an AI agent acting for a customer could find its way around your site. Expert adds a tailored AI Readiness action plan, including the off-site factors a scan alone cannot fix.
Deep scans: Expert only
Fourteen further checks that go beneath the surface of the site, plus a human being who reads the result.
Exposed sensitive files
Config files, backups, repository data and admin endpoints that should not be publicly reachable. Attackers scan for exactly these.
Directory listing
Whether a stranger can browse and download every file in a folder just by visiting it,“not linked” is not the same as “not public”.
WordPress XML-RPC exposure
Whether the legacy endpoint that lets attackers try hundreds of passwords in one request (and amplify attacks on your site) is left switched on.
Leaked API keys & secrets
Credentials accidentally shipped in your website’s JavaScript, where anyone can read them.
Exposed backup & config files
Backups or config files left in the web root, often containing database credentials or a full copy of your site.
Payment-skimming surface (script integrity)
Third-party scripts loading without integrity checks. If one of those providers is compromised, malicious code runs on your checkout, and you would never see it in your own code.
Insecure cookies
Session cookies missing the Secure and HttpOnly flags, making them easier to steal and hijack a logged-in session.
Subdomain takeover risk
Subdomains pointing at services you no longer own: which an attacker can claim and use to phish your customers from your own domain.
Exposed non-production subdomains
Dev, staging and admin subdomains that are publicly discoverable and usually far less protected than production.
Exposed service ports
A safe, limited check for admin and database ports that should not be reachable from the open internet.
TLS / encryption strength
Whether your server still accepts outdated, insecure protocol versions that fail modern standards.
Mixed content
Insecure resources loading on otherwise-secure pages, weakening the padlock.
Advanced email security (MTA-STS, TLS-RPT)
The layer beyond SPF/DKIM/DMARC: enforcing encrypted mail delivery and reporting when it fails.
Performance & SEO (Google Lighthouse)
Full performance and SEO scoring with Core Web Vitals: how fast your site really is, and how well search engines can read it.
Admin sign-in exposure & MFA signals
Whether your admin login is reachable from the open internet, whether it hands off to a single-sign-on provider, and whether a two-factor plugin is visible from outside. Read-only, we never submit a login form. MFA itself is an account setting we cannot see from outside, and the finding says so plainly.
Accessibility barriers (WCAG 2.2 AA: automated)
Colour contrast, missing image alt text and unlabelled form fields, each barrier named with the number of elements affected. An automated check finds common barriers; it is not a WCAG conformance assessment, and the finding says so.
A human review
Every Expert report is read by a cybersecurity professional before it reaches you. They tell you which two findings actually matter this month, and which can wait. That judgement is the one thing no scanner can automate.
What we don't check
This section matters more than the list above. Any company can tell you what it does. Overclaiming is how this industry lost people's trust, so here are our limits, stated plainly.
- This is not a penetration test. We don't attack your site, exploit anything, or attempt to break in. A real penetration test costs thousands and is a different exercise entirely. Anyone selling you one for a few hundred dollars is not selling you one.
- We don't log in. We check what's publicly visible. We never authenticate into your site, admin panel or database, so vulnerabilities that only exist behind a login are outside what we can see.
- We don't touch your customer data. We never read your database, your orders or your customer records. We don't want them and we don't have them.
- We don't give legal advice. When something is a legal judgement (like whether your refund wording breaches the ACL): we flag it for professional review. We tell you what we found and why it's worth a lawyer's eye. We don't rule on it.
- We can't always read a JavaScript-heavy site. Some sites build their content in the browser. When we can't reliably read yours, we say so and mark the scan as limited, rather than reporting things as "missing" when we simply couldn't see them.
- We never scan without permission. Every scan requires you to confirm you own the site or are authorised to check it. We don't scan uninvited, and we will never email you out of the blue to say your website has problems.
- We don’t certify accessibility. Our Expert report runs an automated accessibility check and names the barriers it finds, colour contrast, missing image alt text, unlabelled form fields. Automated testing catches roughly a third of WCAG 2.2 AA. It cannot judge keyboard operability, screen-reader flow, or whether your alt text is meaningful, so it is a starting point and never a conformance verdict. Anyone selling “automated WCAG compliance” is selling something that does not exist, the US Federal Trade Commission fined a vendor US$1 million over that claim in January 2025.
That's the whole picture. If a check isn't on this list, we don't run it, and we won't imply we did.