Security Posture
The trust signals your site publishes to everyone.
Every request to your site returns a set of signals about how seriously it is configured. Security Posture checks the ones that are publicly observable, rates what it finds, and tells you which are worth correcting.
No card required.
- Deterministic checks
- Severity-rated findings
- Fix direction included
What is checked
Deterministic, which is the useful part.
These checks do not involve interpretation or probability. A header is present or it is not, configured correctly or it is not. That makes the findings unusually easy to act on and unusually hard to argue with.
- HTTPS Whether transport is secured, and whether it is applied consistently.
- Security headers The response headers that tell a client how to treat your content.
- Cookie flags Whether cookies are set with the attributes that constrain how they can be used.
- Cache behaviour What is being cached and how, including whether it should be.
- security.txt Whether there is a published route for reporting a problem to you.
Being exact about scope
This is an observation of published signals, not a security assessment.
The distinction matters enough to state plainly. Security Posture looks at what your site tells the world about its configuration. It does not probe your systems, and it cannot tell you whether you are secure. Passing every check here is a reasonable baseline and nothing more.
What this is
- Deterministic checks on publicly observable signals
- A severity rating on what those checks return
- Direction on what to change and why
- A way to watch these signals over time
What this is not
- Penetration testing
- Vulnerability scanning of your systems
- A security or compliance certification
- Any assurance that your site is protected
Formal security assurance is a separate discipline and requires people whose job that is.
Findings you can act on
Each finding carries its evidence and what to do about it.
A severity rating on its own creates anxiety without direction. Every check explains what was observed, why it matters and what changing it involves — which for most of these is a configuration change rather than a project.
-
What was observed
The actual state found, not a category label.
-
Why it matters
What the signal affects, in proportion.
-
What to change
Direction concrete enough to hand to whoever owns the server.
Check the environment you actually serve. Staging and production frequently differ on exactly these headers, and reviewing the wrong one produces confident conclusions about a site nobody visits.
What Security Posture connects to
Trust signals sit alongside the other technical conditions affecting how a site is treated.
See what your headers are telling everyone.
Run the checks and get a severity-rated view with fix direction.
Reviewing a site before onboarding it? Talk to us