Grading
Fifty-one passive checks, usually under ten seconds.
The badge and the link
The badge shows the current grade of the host and links to this report. It updates when the site is re-graded.
Send me this report and the free fixes
The report as a link that lasts, plus the fix pages for every failure with a free fix. A few short emails over two weeks on the classes behind the checks. One-click unsubscribe.
Verify ownership to run the deeper checks
Seven checks need proof that the site is yours, because they request things a visitor never would: env files by URL, the .git directory, admin and API routes, anonymous row reads on every exposed table, storage bucket listing, a ten-request rate-limit probe, and preview URLs behind deployment protection. Seven more run on your own machine with your own keys. Verified projects also get unlimited grades.
Prove control of the host with any one of three methods. The grader checks them in this order.
- 1. DNS record
- A TXT record at
_securealy.your-domainwith the token we give you. Works for every subdomain under it. - 2. Meta tag
<meta name="securealy-verify" content="TOKEN">in the head of the home page. Fastest when you do not control DNS.- 3. Well-known file
- The token as the body of
/.well-known/securealy.txt. Fits a static host with a public folder.
Verification opens with the monitor. Until then, run the deeper checks yourself with the CLI: npx securealy grade <url>, and the local checks with your own keys, which never leave your machine.