Ratings
The sites you use, graded.
The Auditor checks each site once a day: HTTPS, certificates, security headers, cookies, email spoofing protection and the software it gives away. Passive only, the same as a normal visit.
SECURE
$SECURE CA: TBA
Ratings
Grade spread across 45 sites
The site scores a C (60/100). The check found several gaps in how it protects visitor connections and browser settings, but it does not show that anyone has broken in. The most important fix is to make every connection use HTTPS: redirect plain http:// visits to HTTPS, add an HSTS header so browsers stick to it, and turn off the old TLS 1.1 setting. Visitors do not need to panic, but they are more exposed than they should be on hostile networks until these gaps are closed.
Overall, bing.com scored a B (81/100) on this passive check. That is a solid result with a few gaps to close. The most important fix is making the site redirect plain http:// visits to https://, so visitors are not left on an unencrypted connection. Visitors do not need to panic: the findings are mostly low-severity settings that tighten up cookies, browser behavior, and how security reports reach the team.
duckduckgo.com scores A+ (97/100). No serious problems found, but a few settings could be tightened, starting with Content Security Policy allows unsafe scripts.
The site scored an A (93/100), which is a strong result. The most important item is the missing Content Security Policy, a setting that tells browsers which scripts are allowed to run; adding one would make it harder for injected code to steal logins or alter pages. The other finding is informational: a missing CAA record, which would limit which certificate authorities can issue certificates for the domain. Visitors do not need to be worried based on this check alone, since the findings are a hardening gap rather than an active problem.
Overall, this passive check gave perplexity.ai a grade of A+ (97/100), with one low-severity finding. The main item to address is the Content Security Policy, which allows inline or eval'd scripts. That weakens one of the browser protections against injected code, so tightening it is the first thing to do. Visitors do not need to be worried based on these results alone, since the only issue found is rated low.
Overall, this passive check gives wikipedia.org a B (78/100). The findings are mostly missing security headers and cookie settings, with one medium-severity gap: the site has no Content Security Policy, which is the main tool for limiting which scripts can run on a page. The most important fix is to add a Content Security Policy first, then the smaller header and cookie settings. Visitors do not need to be alarmed by this result; it describes hardening that could be improved, not an active break-in or known compromise.
netflix.com scores B (74/100). The biggest issue: old TLS versions still accepted (plus 5 more).
Overall, this passive check gave x.com a top grade of A+ (100/100), with only two informational notes and no serious problems found. The first thing to consider is adding a Permissions-Policy header, which lets the site turn off features like the camera, microphone and location, and the second is adding a CAA record to limit which certificate authorities can issue certificates for the domain. Visitors do not need to be worried based on these results, since both items are minor hardening steps rather than active risks.
The site scores a B (77/100), with no severe problems. The most urgent item is the HTTPS certificate, which the check says expires in 7 days, and after that browsers will warn visitors. Confirm that renewal is in place. The other findings are lower-risk clean-up items, so visitors don't need to be worried by them.
Overall, ebay.com scored a B (81 out of 100) on this passive check. The biggest gap is the missing Content Security Policy, which limits which scripts a page can run, so fixing that first would do the most good. Visitors do not need to panic, because the remaining items are mostly low or informational and the check found no direct sign of an active break-in or stolen data.
Walmart.com scored B (82/100) on this passive check. All six findings are rated low, so this is a solid baseline with some hardening left to do. The first thing to fix is the cookie settings: add the Secure and SameSite flags so cookies are only sent over HTTPS and are not sent along with cross-site requests. Visitors do not need to take any action, and this check alone does not suggest their data is at immediate risk.
paypal.com scores A (94/100). No serious problems found, but a few settings could be tightened, starting with cookies without a SameSite setting.
Overall, the site scores very well on this passive check, with an A+ grade (97/100). The most useful thing to address first is the low-severity issue: scripts loaded from other companies' servers lack integrity checks, so adding them (subresource integrity) would mean a compromised third-party server could not quietly change what runs on your pages. The missing Permissions-Policy header is informational and a smaller matter, but adding it lets you explicitly turn off camera, microphone and location access you don't use. Visitors do not need to be worried; these are minor hardening points, not signs of an active problem.
coinbase.com scores A+ (97/100). No serious problems found, but a few settings could be tightened, starting with Content Security Policy allows unsafe scripts.
Overall, binance.com scores a B (74/100) on this passive check. The main gaps are missing HSTS and Content Security Policy headers, which are standard protections that would make the site harder to attack, and the owner should add HSTS first since it guards the very first connection a visitor makes on untrusted networks. This is a list of hardening steps rather than evidence of an active problem, so visitors have no reason to panic, though they should still use the official site and avoid public Wi-Fi when logging in or handling funds.
Overall, stackoverflow.com scores an A (90/100) on this passive check, which is a strong result. The most important fix is to add an HSTS header, which tells browsers to always use the encrypted HTTPS connection and blocks the chance of a first visit being downgraded to plain HTTP on hostile Wi-Fi. Visitors do not need to be worried: the check found no active problem, and the other items are a tighter content security policy and a security.txt file so researchers know where to report issues.
Vercel's website scored an A (94 out of 100) on this passive check, which is a strong result. The most important item to fix first is the Content Security Policy, which allows inline and eval'd scripts and so weakens protection against injected code. Visitors do not need to be worried. The other two items are minor: the X-Powered-By header reveals the platform, and the site has no Permissions-Policy header to switch off features like the camera, microphone and location.
This site scores B (81/100), a solid result with some hardening gaps. The most important fix is adding a Content Security Policy, which limits which scripts can run on the page and makes code-injection attacks harder. Visitors have no reason to worry from this check alone, but the owner should confirm the server's PHP version is current, since this scan could not see it.
The site scores A (87 out of 100), and this passive check found no serious problems. The most important fix is to turn off the old TLS 1.1 setting, and the owner should confirm the server runs a current PHP version with the patch for the PHP2Shell flaw, since the check could not see which version is in use. Visitors do not need to worry; these findings are about tightening settings, not signs that the site can be broken into today.
Overall, this passive check gives microsoft.com a B (75 out of 100). The most important item to fix first is the missing Content Security Policy, which would limit which scripts can run on the pages and make code-injection attacks harder. The other findings are mostly low severity, covering cookie settings, framing, and a few browser headers. Visitors do not need to panic, but the site owner should work through the list, starting with the Content Security Policy.
Overall, this passive check gives zoom.us a B (84/100). The main gap is the missing Content Security Policy, which is the most important thing to fix first. It limits which scripts can run on the page, so adding one would make it harder for injected code to steal logins or change what visitors see. The other findings are lower risk: missing protections against the page being framed by other sites, a browser file-type guess setting, unchecked third-party scripts, and a few missing headers and contact details for reporting problems. Based only on these findings, visitors do not need to take immediate action. This check does not confirm whether any attack has happened or is happening.
This is a passive check of spotify.com. It scored an A (88/100), and it found seven minor items, none rated higher than low. The most useful first step for the site owner is to tighten the Content Security Policy by removing the allowance for unsafe inline and eval'd scripts, and to add integrity checks to third-party scripts where the provider supports them. Visitors do not need to be worried. The findings are hardening gaps, not evidence that anyone is being attacked or that visitor data is currently at risk.
Overall, shopify.com scored an A (87 out of 100). The check found five items to improve, and none of them are urgent. The most important fix is adding a Content Security Policy, which limits which scripts can run on the page and makes it harder for injected code to steal logins or change what visitors see. Visitors do not need to be worried based on this check alone, since the findings are about hardening the site rather than signs of an active problem.
robinhood.com scores A+ (97/100). No serious problems found, but a few settings could be tightened, starting with Content Security Policy allows unsafe scripts.
pump.fun scores A (90/100). The biggest issue: session cookies readable by scripts (plus 1 more).