{
  "schema_version": 1,
  "run": "20261030-python",
  "run_date": "2026-10-30",
  "started_at": "2026-10-30T00:28:52.924293+00:00",
  "completed_at": "2026-10-30T00:44:30.843644+00:00",
  "created_at": "2026-10-30T00:45:04.716842+00:00",
  "results_sha256": "a8ed5793216799df3c86dfbc116695138d3f1c832b16d8cd2ad2a9385703168e",
  "scanner_sha256": "7f9723e54afdd68951497ba8611ddbb1dcf09502f733012e21e726d0820b47e5",
  "sample_csv_sha256": "21cee08747805c67bbf3ef3cd3c98c0d230c3067e4f3d7fee40dc14ebed209c2",
  "sample": {
    "selected": 207,
    "target_sample": 300,
    "target_shortfall": 93,
    "candidate_result_count": 314,
    "candidate_results_outside_final_selection": 107,
    "preferred_staff_min": 20,
    "preferred_staff_max": 500,
    "duplicate_final_sites": 0,
    "size_evidence": {
      "headcount_unverified": 162,
      "source_reports_20_to_500": 45
    },
    "source_types": {
      "primary portfolio": 134,
      "YC community mirror": 41,
      "secondary India software directory": 32
    },
    "definition": "Public-directory convenience sample of India-connected fintech, B2B SaaS and AI product websites. Not a random or representative sample.",
    "segment_rule": "Fintech first, then explicit AI product tags, then B2B SaaS/software. Mutually exclusive groups.",
    "size_rule": "Known staff counts outside 20 to 500 excluded; unknown counts retained and disclosed. Source metadata is not independently audited.",
    "source_manifest_sha256": "8d8a752bf28565375b9254042617c72ddcca654fcf673719997327bc2688b5e1",
    "candidate_rows_reviewed": 304,
    "rows_excluded": 97,
    "rows_relabelled": 9,
    "rows_excluded_by_reason": {
      "training_not_ai_product": 2,
      "services_or_consultancy": 26,
      "hardware_physical_or_healthcare_service": 13,
      "consumer_marketplace_or_media": 6,
      "established_scale_or_public": 27,
      "institution_or_holding_company": 3,
      "duplicate_company_domain": 1,
      "acquired_product": 3,
      "insufficient_product_evidence": 6,
      "non_fintech_or_parked_domain": 4,
      "conventional_financial_service_not_digital_product": 4,
      "no_substantiated_india_connection": 2
    }
  },
  "method": {
    "engine": "Local Python port of all 25 distinct PHP check IDs. No PHP or Docker used.",
    "limits": "24-second scan budget; at most 16 domain workers; at most four concurrent GETs per domain; 32 KiB per response; no automatic retry.",
    "grade": "A >=90, B >=75, C >=60, D >=45, otherwise F. No E band. Missing trusted HTTPS or confirmed .env/.git caps at F. Basic/deep scores normalised over measured weights and blended 70/30.",
    "comparison": "Research grades are not directly comparable to production grades because unmeasured checks do not receive points or penalties.",
    "rates": "Whole percentages rounded half up. Numerator / measured denominator; unknown and inapplicable excluded. Counts pool before percentages. At-least-one-fail uses all readable sites and counts observed failures only.",
    "scope": "Public home-page response, bounded known-path GETs, DNS, certificate and TLS handshakes. No login, form submission, exploit or subdomain HTTP request.",
    "email": "Exact input hostname without www; organisational-domain inheritance, SPF include expansion, DMARC pct/subdomain alignment and actual mail delivery are not tested.",
    "tls": "Only a completed handshake proves support. Only explicit peer protocol-version alerts prove refusal; ambiguous failures and timeouts are unknown. Cipher check describes one negotiated cipher, not the full supported suite.",
    "surface": "Subdomain naming indicates review, not confirmed compromise. CT lookup is bounded and may be incomplete. Cookie flags describe the home page only, not authenticated sessions.",
    "files": "Only content signatures count as exposed. Soft-404 and home-page matching suppress false positives. Blocked or incomplete probes do not prove absence. Raw response bodies, usernames and cookie values are not saved.",
    "interpretation": "A missing protective header is an observed configuration gap, not proof of an exploitable vulnerability or a breach."
  },
  "overall": {
    "attempted": 207,
    "checked": 193,
    "could_not_check": 14,
    "could_not_check_reasons": {
      "access_denied": 3,
      "dns_or_offline": 6,
      "firewall_challenge": 5
    },
    "run_date": "2026-10-30",
    "median_score": 76,
    "grades": {
      "A": {
        "count": 15,
        "denominator": 193,
        "percent": 8,
        "unknown": 0,
        "population": 193,
        "run_date": "2026-10-30"
      },
      "B": {
        "count": 89,
        "denominator": 193,
        "percent": 46,
        "unknown": 0,
        "population": 193,
        "run_date": "2026-10-30"
      },
      "C": {
        "count": 69,
        "denominator": 193,
        "percent": 36,
        "unknown": 0,
        "population": 193,
        "run_date": "2026-10-30"
      },
      "D": {
        "count": 16,
        "denominator": 193,
        "percent": 8,
        "unknown": 0,
        "population": 193,
        "run_date": "2026-10-30"
      },
      "E": {
        "count": 0,
        "denominator": 193,
        "percent": 0,
        "unknown": 0,
        "population": 193,
        "run_date": "2026-10-30"
      },
      "F": {
        "count": 4,
        "denominator": 193,
        "percent": 2,
        "unknown": 0,
        "population": 193,
        "run_date": "2026-10-30"
      }
    },
    "metrics": {
      "no_dmarc_policy": {
        "label": "No valid DMARC policy found",
        "count": 18,
        "denominator": 193,
        "percent": 9,
        "unknown": 0,
        "population": 193,
        "run_date": "2026-10-30"
      },
      "no_enforcing_dmarc": {
        "label": "DMARC absent or not enforcing quarantine/reject",
        "count": 87,
        "denominator": 193,
        "percent": 45,
        "unknown": 0,
        "population": 193,
        "run_date": "2026-10-30"
      },
      "spf_missing_or_soft": {
        "label": "SPF missing, invalid, soft, neutral or permissive",
        "count": 150,
        "denominator": 188,
        "percent": 80,
        "unknown": 5,
        "population": 193,
        "run_date": "2026-10-30"
      },
      "no_csp": {
        "label": "No enforced Content-Security-Policy header",
        "count": 108,
        "denominator": 193,
        "percent": 56,
        "unknown": 0,
        "population": 193,
        "run_date": "2026-10-30"
      },
      "no_hsts": {
        "label": "No positive HSTS max-age",
        "count": 53,
        "denominator": 193,
        "percent": 27,
        "unknown": 0,
        "population": 193,
        "run_date": "2026-10-30"
      },
      "clickjacking_unprotected": {
        "label": "No recognised framing protection",
        "count": 89,
        "denominator": 193,
        "percent": 46,
        "unknown": 0,
        "population": 193,
        "run_date": "2026-10-30"
      },
      "env_exposed": {
        "label": "Public .env signature confirmed",
        "count": 0,
        "denominator": 106,
        "percent": 0,
        "unknown": 87,
        "population": 193,
        "run_date": "2026-10-30"
      },
      "git_exposed": {
        "label": "Public .git/HEAD signature confirmed",
        "count": 1,
        "denominator": 108,
        "percent": 1,
        "unknown": 85,
        "population": 193,
        "run_date": "2026-10-30"
      },
      "sensitive_paths_exposed": {
        "label": "Sensitive file content confirmed in path probes",
        "count": 6,
        "denominator": 52,
        "percent": 12,
        "unknown": 141,
        "population": 193,
        "run_date": "2026-10-30"
      },
      "exposed_env_git_or_files": {
        "label": "Public .env, .git or sensitive file content confirmed",
        "count": 6,
        "denominator": 40,
        "percent": 15,
        "unknown": 153,
        "population": 193,
        "run_date": "2026-10-30"
      },
      "header_disclosure": {
        "label": "Server version or software-identifying header visible",
        "count": 70,
        "denominator": 193,
        "percent": 36,
        "unknown": 0,
        "population": 193,
        "run_date": "2026-10-30"
      },
      "exact_versions_visible": {
        "label": "Exact software version visible in page or headers",
        "count": 50,
        "denominator": 193,
        "percent": 26,
        "unknown": 0,
        "population": 193,
        "run_date": "2026-10-30"
      },
      "securitytxt_present": {
        "label": "security.txt with a Contact line found",
        "count": 11,
        "denominator": 185,
        "percent": 6,
        "unknown": 8,
        "population": 193,
        "run_date": "2026-10-30"
      },
      "legacy_tls_accepted": {
        "label": "TLS 1.0 or 1.1 handshake accepted",
        "count": 19,
        "denominator": 190,
        "percent": 10,
        "unknown": 3,
        "population": 193,
        "run_date": "2026-10-30"
      },
      "cookies_without_secure": {
        "label": "Home page sets a cookie without Secure",
        "count": 13,
        "denominator": 193,
        "percent": 7,
        "unknown": 0,
        "population": 193,
        "run_date": "2026-10-30"
      },
      "cookies_without_httponly": {
        "label": "Home page sets a cookie without HttpOnly",
        "count": 15,
        "denominator": 193,
        "percent": 8,
        "unknown": 0,
        "population": 193,
        "run_date": "2026-10-30"
      },
      "cookies_missing_either_flag": {
        "label": "Home page sets a cookie without Secure or HttpOnly",
        "count": 16,
        "denominator": 193,
        "percent": 8,
        "unknown": 0,
        "population": 193,
        "run_date": "2026-10-30"
      },
      "cookie_setters_missing_either_flag": {
        "label": "Cookie-setting home pages missing Secure or HttpOnly",
        "count": 16,
        "denominator": 64,
        "percent": 25,
        "unknown": 129,
        "population": 193,
        "run_date": "2026-10-30"
      },
      "at_least_one_fail": {
        "label": "At least one observed fail",
        "count": 159,
        "denominator": 193,
        "percent": 82,
        "unknown": 0,
        "population": 193,
        "run_date": "2026-10-30"
      }
    },
    "checks": {
      "https": {
        "title": "HTTPS works",
        "group": "https",
        "run_date": "2026-10-30",
        "population": 193,
        "denominator": 193,
        "unknown_or_inapplicable": 0,
        "status_counts": {
          "pass": 190,
          "warn": 0,
          "fail": 3
        },
        "status_percent": {
          "pass": 98,
          "warn": 0,
          "fail": 2
        },
        "fix": "Install a free certificate (Let\u2019s Encrypt, or your host\u2019s one-click SSL) and serve the whole site over HTTPS."
      },
      "redirect": {
        "title": "Plain HTTP redirects to HTTPS",
        "group": "https",
        "run_date": "2026-10-30",
        "population": 193,
        "denominator": 188,
        "unknown_or_inapplicable": 5,
        "status_counts": {
          "pass": 184,
          "warn": 0,
          "fail": 4
        },
        "status_percent": {
          "pass": 98,
          "warn": 0,
          "fail": 2
        },
        "fix": "Add a permanent (301) redirect from every http:// address to the same https:// address."
      },
      "hsts": {
        "title": "Browsers are told to always use HTTPS (HSTS)",
        "group": "https",
        "run_date": "2026-10-30",
        "population": 193,
        "denominator": 193,
        "unknown_or_inapplicable": 0,
        "status_counts": {
          "pass": 137,
          "warn": 3,
          "fail": 53
        },
        "status_percent": {
          "pass": 71,
          "warn": 2,
          "fail": 27
        },
        "fix": "Add the header Strict-Transport-Security: max-age=31536000; includeSubDomains"
      },
      "cert": {
        "title": "Certificate is valid and not about to expire",
        "group": "https",
        "run_date": "2026-10-30",
        "population": 193,
        "denominator": 193,
        "unknown_or_inapplicable": 0,
        "status_counts": {
          "pass": 190,
          "warn": 0,
          "fail": 3
        },
        "status_percent": {
          "pass": 98,
          "warn": 0,
          "fail": 2
        },
        "fix": "Renew it now and switch on automatic renewal so it never lapses."
      },
      "csp": {
        "title": "Content Security Policy limits what can run",
        "group": "headers",
        "run_date": "2026-10-30",
        "population": 193,
        "denominator": 193,
        "unknown_or_inapplicable": 0,
        "status_counts": {
          "pass": 64,
          "warn": 26,
          "fail": 103
        },
        "status_percent": {
          "pass": 33,
          "warn": 13,
          "fail": 53
        },
        "fix": "Start with Content-Security-Policy: default-src 'self' and add the sources your site really uses."
      },
      "framing": {
        "title": "Protected against clickjacking",
        "group": "headers",
        "run_date": "2026-10-30",
        "population": 193,
        "denominator": 193,
        "unknown_or_inapplicable": 0,
        "status_counts": {
          "pass": 104,
          "warn": 0,
          "fail": 89
        },
        "status_percent": {
          "pass": 54,
          "warn": 0,
          "fail": 46
        },
        "fix": "Add X-Frame-Options: DENY (or frame-ancestors 'none' in your CSP)."
      },
      "nosniff": {
        "title": "Browsers will not guess file types",
        "group": "headers",
        "run_date": "2026-10-30",
        "population": 193,
        "denominator": 193,
        "unknown_or_inapplicable": 0,
        "status_counts": {
          "pass": 89,
          "warn": 0,
          "fail": 104
        },
        "status_percent": {
          "pass": 46,
          "warn": 0,
          "fail": 54
        },
        "fix": "Add the header X-Content-Type-Options: nosniff"
      },
      "referrer": {
        "title": "Page addresses are not leaked to other sites",
        "group": "headers",
        "run_date": "2026-10-30",
        "population": 193,
        "denominator": 193,
        "unknown_or_inapplicable": 0,
        "status_counts": {
          "pass": 67,
          "warn": 126,
          "fail": 0
        },
        "status_percent": {
          "pass": 35,
          "warn": 65,
          "fail": 0
        },
        "fix": "Add the header Referrer-Policy: strict-origin-when-cross-origin"
      },
      "permissions": {
        "title": "Camera, microphone and location are locked down",
        "group": "headers",
        "run_date": "2026-10-30",
        "population": 193,
        "denominator": 193,
        "unknown_or_inapplicable": 0,
        "status_counts": {
          "pass": 35,
          "warn": 158,
          "fail": 0
        },
        "status_percent": {
          "pass": 18,
          "warn": 82,
          "fail": 0
        },
        "fix": "Add Permissions-Policy: camera=(), microphone=(), geolocation=()"
      },
      "spf": {
        "title": "SPF says who may send email as you",
        "group": "email",
        "run_date": "2026-10-30",
        "population": 193,
        "denominator": 188,
        "unknown_or_inapplicable": 5,
        "status_counts": {
          "pass": 168,
          "warn": 1,
          "fail": 19
        },
        "status_percent": {
          "pass": 89,
          "warn": 1,
          "fail": 10
        },
        "fix": "Publish a TXT record such as v=spf1 include:<your email provider> -all"
      },
      "dmarc": {
        "title": "DMARC tells receivers to block fake emails",
        "group": "email",
        "run_date": "2026-10-30",
        "population": 193,
        "denominator": 193,
        "unknown_or_inapplicable": 0,
        "status_counts": {
          "pass": 106,
          "warn": 69,
          "fail": 18
        },
        "status_percent": {
          "pass": 55,
          "warn": 36,
          "fail": 9
        },
        "fix": "After checking the reports, move to p=quarantine and then p=reject."
      },
      "git": {
        "title": "Source code history is not public",
        "group": "exposure",
        "run_date": "2026-10-30",
        "population": 193,
        "denominator": 108,
        "unknown_or_inapplicable": 85,
        "status_counts": {
          "pass": 107,
          "warn": 0,
          "fail": 1
        },
        "status_percent": {
          "pass": 99,
          "warn": 0,
          "fail": 1
        },
        "fix": "Block access to /.git on the web server (or deploy without it) today, then change any secrets that were in the code."
      },
      "env": {
        "title": "Secrets file (.env) is not public",
        "group": "exposure",
        "run_date": "2026-10-30",
        "population": 193,
        "denominator": 106,
        "unknown_or_inapplicable": 87,
        "status_counts": {
          "pass": 106,
          "warn": 0,
          "fail": 0
        },
        "status_percent": {
          "pass": 100,
          "warn": 0,
          "fail": 0
        },
        "fix": "Remove it from the web folder or block it on the server now, then change every secret it contains."
      },
      "versions": {
        "title": "Software versions are not advertised",
        "group": "exposure",
        "run_date": "2026-10-30",
        "population": 193,
        "denominator": 193,
        "unknown_or_inapplicable": 0,
        "status_counts": {
          "pass": 123,
          "warn": 70,
          "fail": 0
        },
        "status_percent": {
          "pass": 64,
          "warn": 36,
          "fail": 0
        },
        "fix": "Hide version numbers in the web server and framework settings (e.g. ServerTokens Prod, expose_php = Off)."
      },
      "cookies": {
        "title": "Cookies are protected",
        "group": "exposure",
        "run_date": "2026-10-30",
        "population": 193,
        "denominator": 193,
        "unknown_or_inapplicable": 0,
        "status_counts": {
          "pass": 177,
          "warn": 3,
          "fail": 13
        },
        "status_percent": {
          "pass": 92,
          "warn": 2,
          "fail": 7
        },
        "fix": "Set Secure on every cookie (and HttpOnly and SameSite where scripts don\u2019t need them)."
      },
      "securitytxt": {
        "title": "Security contact is published",
        "group": "exposure",
        "run_date": "2026-10-30",
        "population": 193,
        "denominator": 185,
        "unknown_or_inapplicable": 8,
        "status_counts": {
          "pass": 11,
          "warn": 174,
          "fail": 0
        },
        "status_percent": {
          "pass": 6,
          "warn": 94,
          "fail": 0
        },
        "fix": "Publish /.well-known/security.txt with a Contact: line and an Expires: date (see securitytxt.org)."
      },
      "tlsver": {
        "title": "Only modern TLS versions are accepted",
        "group": "tls",
        "run_date": "2026-10-30",
        "population": 193,
        "denominator": 190,
        "unknown_or_inapplicable": 3,
        "status_counts": {
          "pass": 168,
          "warn": 3,
          "fail": 19
        },
        "status_percent": {
          "pass": 88,
          "warn": 2,
          "fail": 10
        },
        "fix": "Disable TLS 1.0 and 1.1 on the web server or load balancer, keeping TLS 1.2 and 1.3."
      },
      "cipher": {
        "title": "Strong cipher negotiated",
        "group": "tls",
        "run_date": "2026-10-30",
        "population": 193,
        "denominator": 193,
        "unknown_or_inapplicable": 0,
        "status_counts": {
          "pass": 193,
          "warn": 0,
          "fail": 0
        },
        "status_percent": {
          "pass": 100,
          "warn": 0,
          "fail": 0
        },
        "fix": "Prefer AES-GCM or ChaCha20 cipher suites and remove RC4, 3DES and CBC-SHA suites."
      },
      "certsig": {
        "title": "Certificate uses a modern signature",
        "group": "tls",
        "run_date": "2026-10-30",
        "population": 193,
        "denominator": 193,
        "unknown_or_inapplicable": 0,
        "status_counts": {
          "pass": 193,
          "warn": 0,
          "fail": 0
        },
        "status_percent": {
          "pass": 100,
          "warn": 0,
          "fail": 0
        },
        "fix": "Reissue the certificate; any current certificate authority uses SHA-256."
      },
      "subdomains": {
        "title": "No forgotten subdomains",
        "group": "surface",
        "run_date": "2026-10-30",
        "population": 193,
        "denominator": 98,
        "unknown_or_inapplicable": 95,
        "status_counts": {
          "pass": 2,
          "warn": 96,
          "fail": 0
        },
        "status_percent": {
          "pass": 2,
          "warn": 98,
          "fail": 0
        },
        "fix": "Confirm each one is meant to be public. Take down what is not needed; put the rest behind a VPN or login and keep it patched."
      },
      "paths": {
        "title": "No admin pages or sensitive files reachable",
        "group": "surface",
        "run_date": "2026-10-30",
        "population": 193,
        "denominator": 52,
        "unknown_or_inapplicable": 141,
        "status_counts": {
          "pass": 38,
          "warn": 8,
          "fail": 6
        },
        "status_percent": {
          "pass": 73,
          "warn": 15,
          "fail": 12
        },
        "fix": "Remove these files from the web folder or block them on the server. Backups and logs belong outside the site entirely."
      },
      "tech": {
        "title": "Software versions are not advertised on the page",
        "group": "software",
        "run_date": "2026-10-30",
        "population": 193,
        "denominator": 193,
        "unknown_or_inapplicable": 0,
        "status_counts": {
          "pass": 143,
          "warn": 50,
          "fail": 0
        },
        "status_percent": {
          "pass": 74,
          "warn": 26,
          "fail": 0
        },
        "fix": "Remove generator tags and ?ver= query strings from page output (most platforms have a setting or plugin for it), and keep the software updated."
      },
      "wpapi": {
        "title": "WordPress user list is not public",
        "group": "software",
        "run_date": "2026-10-30",
        "population": 193,
        "denominator": 15,
        "unknown_or_inapplicable": 178,
        "status_counts": {
          "pass": 9,
          "warn": 0,
          "fail": 6
        },
        "status_percent": {
          "pass": 60,
          "warn": 0,
          "fail": 40
        },
        "fix": "Restrict the REST users endpoint to logged-in users (a one-line filter or a security plugin), and use two-factor sign-in."
      },
      "cors": {
        "title": "Other websites cannot read your pages",
        "group": "api",
        "run_date": "2026-10-30",
        "population": 193,
        "denominator": 193,
        "unknown_or_inapplicable": 0,
        "status_counts": {
          "pass": 157,
          "warn": 36,
          "fail": 0
        },
        "status_percent": {
          "pass": 81,
          "warn": 19,
          "fail": 0
        },
        "fix": "Allow only the specific origins that need access, and never combine * with credentials."
      },
      "samesite": {
        "title": "Cookies are protected from cross-site requests",
        "group": "api",
        "run_date": "2026-10-30",
        "population": 193,
        "denominator": 193,
        "unknown_or_inapplicable": 0,
        "status_counts": {
          "pass": 185,
          "warn": 8,
          "fail": 0
        },
        "status_percent": {
          "pass": 96,
          "warn": 4,
          "fail": 0
        },
        "fix": "Add SameSite=Lax (or Strict) to every cookie."
      }
    }
  },
  "segments": {
    "fintech": {
      "attempted": 66,
      "checked": 61,
      "could_not_check": 5,
      "could_not_check_reasons": {
        "access_denied": 2,
        "dns_or_offline": 2,
        "firewall_challenge": 1
      },
      "run_date": "2026-10-30",
      "median_score": 75,
      "grades": {
        "A": {
          "count": 5,
          "denominator": 61,
          "percent": 8,
          "unknown": 0,
          "population": 61,
          "run_date": "2026-10-30"
        },
        "B": {
          "count": 26,
          "denominator": 61,
          "percent": 43,
          "unknown": 0,
          "population": 61,
          "run_date": "2026-10-30"
        },
        "C": {
          "count": 20,
          "denominator": 61,
          "percent": 33,
          "unknown": 0,
          "population": 61,
          "run_date": "2026-10-30"
        },
        "D": {
          "count": 6,
          "denominator": 61,
          "percent": 10,
          "unknown": 0,
          "population": 61,
          "run_date": "2026-10-30"
        },
        "E": {
          "count": 0,
          "denominator": 61,
          "percent": 0,
          "unknown": 0,
          "population": 61,
          "run_date": "2026-10-30"
        },
        "F": {
          "count": 4,
          "denominator": 61,
          "percent": 7,
          "unknown": 0,
          "population": 61,
          "run_date": "2026-10-30"
        }
      },
      "metrics": {
        "no_dmarc_policy": {
          "label": "No valid DMARC policy found",
          "count": 8,
          "denominator": 61,
          "percent": 13,
          "unknown": 0,
          "population": 61,
          "run_date": "2026-10-30"
        },
        "no_enforcing_dmarc": {
          "label": "DMARC absent or not enforcing quarantine/reject",
          "count": 31,
          "denominator": 61,
          "percent": 51,
          "unknown": 0,
          "population": 61,
          "run_date": "2026-10-30"
        },
        "spf_missing_or_soft": {
          "label": "SPF missing, invalid, soft, neutral or permissive",
          "count": 46,
          "denominator": 60,
          "percent": 77,
          "unknown": 1,
          "population": 61,
          "run_date": "2026-10-30"
        },
        "no_csp": {
          "label": "No enforced Content-Security-Policy header",
          "count": 31,
          "denominator": 61,
          "percent": 51,
          "unknown": 0,
          "population": 61,
          "run_date": "2026-10-30"
        },
        "no_hsts": {
          "label": "No positive HSTS max-age",
          "count": 26,
          "denominator": 61,
          "percent": 43,
          "unknown": 0,
          "population": 61,
          "run_date": "2026-10-30"
        },
        "clickjacking_unprotected": {
          "label": "No recognised framing protection",
          "count": 26,
          "denominator": 61,
          "percent": 43,
          "unknown": 0,
          "population": 61,
          "run_date": "2026-10-30"
        },
        "env_exposed": {
          "label": "Public .env signature confirmed",
          "count": 0,
          "denominator": 33,
          "percent": 0,
          "unknown": 28,
          "population": 61,
          "run_date": "2026-10-30"
        },
        "git_exposed": {
          "label": "Public .git/HEAD signature confirmed",
          "count": 1,
          "denominator": 35,
          "percent": 3,
          "unknown": 26,
          "population": 61,
          "run_date": "2026-10-30"
        },
        "sensitive_paths_exposed": {
          "label": "Sensitive file content confirmed in path probes",
          "count": 2,
          "denominator": 21,
          "percent": 10,
          "unknown": 40,
          "population": 61,
          "run_date": "2026-10-30"
        },
        "exposed_env_git_or_files": {
          "label": "Public .env, .git or sensitive file content confirmed",
          "count": 2,
          "denominator": 15,
          "percent": 13,
          "unknown": 46,
          "population": 61,
          "run_date": "2026-10-30"
        },
        "header_disclosure": {
          "label": "Server version or software-identifying header visible",
          "count": 29,
          "denominator": 61,
          "percent": 48,
          "unknown": 0,
          "population": 61,
          "run_date": "2026-10-30"
        },
        "exact_versions_visible": {
          "label": "Exact software version visible in page or headers",
          "count": 24,
          "denominator": 61,
          "percent": 39,
          "unknown": 0,
          "population": 61,
          "run_date": "2026-10-30"
        },
        "securitytxt_present": {
          "label": "security.txt with a Contact line found",
          "count": 1,
          "denominator": 58,
          "percent": 2,
          "unknown": 3,
          "population": 61,
          "run_date": "2026-10-30"
        },
        "legacy_tls_accepted": {
          "label": "TLS 1.0 or 1.1 handshake accepted",
          "count": 6,
          "denominator": 60,
          "percent": 10,
          "unknown": 1,
          "population": 61,
          "run_date": "2026-10-30"
        },
        "cookies_without_secure": {
          "label": "Home page sets a cookie without Secure",
          "count": 2,
          "denominator": 61,
          "percent": 3,
          "unknown": 0,
          "population": 61,
          "run_date": "2026-10-30"
        },
        "cookies_without_httponly": {
          "label": "Home page sets a cookie without HttpOnly",
          "count": 2,
          "denominator": 61,
          "percent": 3,
          "unknown": 0,
          "population": 61,
          "run_date": "2026-10-30"
        },
        "cookies_missing_either_flag": {
          "label": "Home page sets a cookie without Secure or HttpOnly",
          "count": 2,
          "denominator": 61,
          "percent": 3,
          "unknown": 0,
          "population": 61,
          "run_date": "2026-10-30"
        },
        "cookie_setters_missing_either_flag": {
          "label": "Cookie-setting home pages missing Secure or HttpOnly",
          "count": 2,
          "denominator": 11,
          "percent": 18,
          "unknown": 50,
          "population": 61,
          "run_date": "2026-10-30"
        },
        "at_least_one_fail": {
          "label": "At least one observed fail",
          "count": 51,
          "denominator": 61,
          "percent": 84,
          "unknown": 0,
          "population": 61,
          "run_date": "2026-10-30"
        }
      },
      "checks": {
        "https": {
          "title": "HTTPS works",
          "group": "https",
          "run_date": "2026-10-30",
          "population": 61,
          "denominator": 61,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 58,
            "warn": 0,
            "fail": 3
          },
          "status_percent": {
            "pass": 95,
            "warn": 0,
            "fail": 5
          },
          "fix": "Install a free certificate (Let\u2019s Encrypt, or your host\u2019s one-click SSL) and serve the whole site over HTTPS."
        },
        "redirect": {
          "title": "Plain HTTP redirects to HTTPS",
          "group": "https",
          "run_date": "2026-10-30",
          "population": 61,
          "denominator": 59,
          "unknown_or_inapplicable": 2,
          "status_counts": {
            "pass": 57,
            "warn": 0,
            "fail": 2
          },
          "status_percent": {
            "pass": 97,
            "warn": 0,
            "fail": 3
          },
          "fix": "Add a permanent (301) redirect from every http:// address to the same https:// address."
        },
        "hsts": {
          "title": "Browsers are told to always use HTTPS (HSTS)",
          "group": "https",
          "run_date": "2026-10-30",
          "population": 61,
          "denominator": 61,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 34,
            "warn": 1,
            "fail": 26
          },
          "status_percent": {
            "pass": 56,
            "warn": 2,
            "fail": 43
          },
          "fix": "Add the header Strict-Transport-Security: max-age=31536000; includeSubDomains"
        },
        "cert": {
          "title": "Certificate is valid and not about to expire",
          "group": "https",
          "run_date": "2026-10-30",
          "population": 61,
          "denominator": 61,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 58,
            "warn": 0,
            "fail": 3
          },
          "status_percent": {
            "pass": 95,
            "warn": 0,
            "fail": 5
          },
          "fix": "Renew it now and switch on automatic renewal so it never lapses."
        },
        "csp": {
          "title": "Content Security Policy limits what can run",
          "group": "headers",
          "run_date": "2026-10-30",
          "population": 61,
          "denominator": 61,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 21,
            "warn": 9,
            "fail": 31
          },
          "status_percent": {
            "pass": 34,
            "warn": 15,
            "fail": 51
          },
          "fix": "Start with Content-Security-Policy: default-src 'self' and add the sources your site really uses."
        },
        "framing": {
          "title": "Protected against clickjacking",
          "group": "headers",
          "run_date": "2026-10-30",
          "population": 61,
          "denominator": 61,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 35,
            "warn": 0,
            "fail": 26
          },
          "status_percent": {
            "pass": 57,
            "warn": 0,
            "fail": 43
          },
          "fix": "Add X-Frame-Options: DENY (or frame-ancestors 'none' in your CSP)."
        },
        "nosniff": {
          "title": "Browsers will not guess file types",
          "group": "headers",
          "run_date": "2026-10-30",
          "population": 61,
          "denominator": 61,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 32,
            "warn": 0,
            "fail": 29
          },
          "status_percent": {
            "pass": 52,
            "warn": 0,
            "fail": 48
          },
          "fix": "Add the header X-Content-Type-Options: nosniff"
        },
        "referrer": {
          "title": "Page addresses are not leaked to other sites",
          "group": "headers",
          "run_date": "2026-10-30",
          "population": 61,
          "denominator": 61,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 21,
            "warn": 40,
            "fail": 0
          },
          "status_percent": {
            "pass": 34,
            "warn": 66,
            "fail": 0
          },
          "fix": "Add the header Referrer-Policy: strict-origin-when-cross-origin"
        },
        "permissions": {
          "title": "Camera, microphone and location are locked down",
          "group": "headers",
          "run_date": "2026-10-30",
          "population": 61,
          "denominator": 61,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 8,
            "warn": 53,
            "fail": 0
          },
          "status_percent": {
            "pass": 13,
            "warn": 87,
            "fail": 0
          },
          "fix": "Add Permissions-Policy: camera=(), microphone=(), geolocation=()"
        },
        "spf": {
          "title": "SPF says who may send email as you",
          "group": "email",
          "run_date": "2026-10-30",
          "population": 61,
          "denominator": 60,
          "unknown_or_inapplicable": 1,
          "status_counts": {
            "pass": 54,
            "warn": 0,
            "fail": 6
          },
          "status_percent": {
            "pass": 90,
            "warn": 0,
            "fail": 10
          },
          "fix": "Publish a TXT record such as v=spf1 include:<your email provider> -all"
        },
        "dmarc": {
          "title": "DMARC tells receivers to block fake emails",
          "group": "email",
          "run_date": "2026-10-30",
          "population": 61,
          "denominator": 61,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 30,
            "warn": 23,
            "fail": 8
          },
          "status_percent": {
            "pass": 49,
            "warn": 38,
            "fail": 13
          },
          "fix": "After checking the reports, move to p=quarantine and then p=reject."
        },
        "git": {
          "title": "Source code history is not public",
          "group": "exposure",
          "run_date": "2026-10-30",
          "population": 61,
          "denominator": 35,
          "unknown_or_inapplicable": 26,
          "status_counts": {
            "pass": 34,
            "warn": 0,
            "fail": 1
          },
          "status_percent": {
            "pass": 97,
            "warn": 0,
            "fail": 3
          },
          "fix": "Block access to /.git on the web server (or deploy without it) today, then change any secrets that were in the code."
        },
        "env": {
          "title": "Secrets file (.env) is not public",
          "group": "exposure",
          "run_date": "2026-10-30",
          "population": 61,
          "denominator": 33,
          "unknown_or_inapplicable": 28,
          "status_counts": {
            "pass": 33,
            "warn": 0,
            "fail": 0
          },
          "status_percent": {
            "pass": 100,
            "warn": 0,
            "fail": 0
          },
          "fix": "Remove it from the web folder or block it on the server now, then change every secret it contains."
        },
        "versions": {
          "title": "Software versions are not advertised",
          "group": "exposure",
          "run_date": "2026-10-30",
          "population": 61,
          "denominator": 61,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 32,
            "warn": 29,
            "fail": 0
          },
          "status_percent": {
            "pass": 52,
            "warn": 48,
            "fail": 0
          },
          "fix": "Hide version numbers in the web server and framework settings (e.g. ServerTokens Prod, expose_php = Off)."
        },
        "cookies": {
          "title": "Cookies are protected",
          "group": "exposure",
          "run_date": "2026-10-30",
          "population": 61,
          "denominator": 61,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 59,
            "warn": 0,
            "fail": 2
          },
          "status_percent": {
            "pass": 97,
            "warn": 0,
            "fail": 3
          },
          "fix": "Set Secure on every cookie (and HttpOnly and SameSite where scripts don\u2019t need them)."
        },
        "securitytxt": {
          "title": "Security contact is published",
          "group": "exposure",
          "run_date": "2026-10-30",
          "population": 61,
          "denominator": 58,
          "unknown_or_inapplicable": 3,
          "status_counts": {
            "pass": 1,
            "warn": 57,
            "fail": 0
          },
          "status_percent": {
            "pass": 2,
            "warn": 98,
            "fail": 0
          },
          "fix": "Publish /.well-known/security.txt with a Contact: line and an Expires: date (see securitytxt.org)."
        },
        "tlsver": {
          "title": "Only modern TLS versions are accepted",
          "group": "tls",
          "run_date": "2026-10-30",
          "population": 61,
          "denominator": 60,
          "unknown_or_inapplicable": 1,
          "status_counts": {
            "pass": 51,
            "warn": 3,
            "fail": 6
          },
          "status_percent": {
            "pass": 85,
            "warn": 5,
            "fail": 10
          },
          "fix": "Disable TLS 1.0 and 1.1 on the web server or load balancer, keeping TLS 1.2 and 1.3."
        },
        "cipher": {
          "title": "Strong cipher negotiated",
          "group": "tls",
          "run_date": "2026-10-30",
          "population": 61,
          "denominator": 61,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 61,
            "warn": 0,
            "fail": 0
          },
          "status_percent": {
            "pass": 100,
            "warn": 0,
            "fail": 0
          },
          "fix": "Prefer AES-GCM or ChaCha20 cipher suites and remove RC4, 3DES and CBC-SHA suites."
        },
        "certsig": {
          "title": "Certificate uses a modern signature",
          "group": "tls",
          "run_date": "2026-10-30",
          "population": 61,
          "denominator": 61,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 61,
            "warn": 0,
            "fail": 0
          },
          "status_percent": {
            "pass": 100,
            "warn": 0,
            "fail": 0
          },
          "fix": "Reissue the certificate; any current certificate authority uses SHA-256."
        },
        "subdomains": {
          "title": "No forgotten subdomains",
          "group": "surface",
          "run_date": "2026-10-30",
          "population": 61,
          "denominator": 39,
          "unknown_or_inapplicable": 22,
          "status_counts": {
            "pass": 0,
            "warn": 39,
            "fail": 0
          },
          "status_percent": {
            "pass": 0,
            "warn": 100,
            "fail": 0
          },
          "fix": "Confirm each one is meant to be public. Take down what is not needed; put the rest behind a VPN or login and keep it patched."
        },
        "paths": {
          "title": "No admin pages or sensitive files reachable",
          "group": "surface",
          "run_date": "2026-10-30",
          "population": 61,
          "denominator": 21,
          "unknown_or_inapplicable": 40,
          "status_counts": {
            "pass": 16,
            "warn": 3,
            "fail": 2
          },
          "status_percent": {
            "pass": 76,
            "warn": 14,
            "fail": 10
          },
          "fix": "Remove these files from the web folder or block them on the server. Backups and logs belong outside the site entirely."
        },
        "tech": {
          "title": "Software versions are not advertised on the page",
          "group": "software",
          "run_date": "2026-10-30",
          "population": 61,
          "denominator": 61,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 37,
            "warn": 24,
            "fail": 0
          },
          "status_percent": {
            "pass": 61,
            "warn": 39,
            "fail": 0
          },
          "fix": "Remove generator tags and ?ver= query strings from page output (most platforms have a setting or plugin for it), and keep the software updated."
        },
        "wpapi": {
          "title": "WordPress user list is not public",
          "group": "software",
          "run_date": "2026-10-30",
          "population": 61,
          "denominator": 3,
          "unknown_or_inapplicable": 58,
          "status_counts": {
            "pass": 2,
            "warn": 0,
            "fail": 1
          },
          "status_percent": {
            "pass": 67,
            "warn": 0,
            "fail": 33
          },
          "fix": "Restrict the REST users endpoint to logged-in users (a one-line filter or a security plugin), and use two-factor sign-in."
        },
        "cors": {
          "title": "Other websites cannot read your pages",
          "group": "api",
          "run_date": "2026-10-30",
          "population": 61,
          "denominator": 61,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 56,
            "warn": 5,
            "fail": 0
          },
          "status_percent": {
            "pass": 92,
            "warn": 8,
            "fail": 0
          },
          "fix": "Allow only the specific origins that need access, and never combine * with credentials."
        },
        "samesite": {
          "title": "Cookies are protected from cross-site requests",
          "group": "api",
          "run_date": "2026-10-30",
          "population": 61,
          "denominator": 61,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 57,
            "warn": 4,
            "fail": 0
          },
          "status_percent": {
            "pass": 93,
            "warn": 7,
            "fail": 0
          },
          "fix": "Add SameSite=Lax (or Strict) to every cookie."
        }
      }
    },
    "saas": {
      "attempted": 42,
      "checked": 38,
      "could_not_check": 4,
      "could_not_check_reasons": {
        "dns_or_offline": 1,
        "firewall_challenge": 3
      },
      "run_date": "2026-10-30",
      "median_score": 79.0,
      "grades": {
        "A": {
          "count": 3,
          "denominator": 38,
          "percent": 8,
          "unknown": 0,
          "population": 38,
          "run_date": "2026-10-30"
        },
        "B": {
          "count": 20,
          "denominator": 38,
          "percent": 53,
          "unknown": 0,
          "population": 38,
          "run_date": "2026-10-30"
        },
        "C": {
          "count": 13,
          "denominator": 38,
          "percent": 34,
          "unknown": 0,
          "population": 38,
          "run_date": "2026-10-30"
        },
        "D": {
          "count": 2,
          "denominator": 38,
          "percent": 5,
          "unknown": 0,
          "population": 38,
          "run_date": "2026-10-30"
        },
        "E": {
          "count": 0,
          "denominator": 38,
          "percent": 0,
          "unknown": 0,
          "population": 38,
          "run_date": "2026-10-30"
        },
        "F": {
          "count": 0,
          "denominator": 38,
          "percent": 0,
          "unknown": 0,
          "population": 38,
          "run_date": "2026-10-30"
        }
      },
      "metrics": {
        "no_dmarc_policy": {
          "label": "No valid DMARC policy found",
          "count": 2,
          "denominator": 38,
          "percent": 5,
          "unknown": 0,
          "population": 38,
          "run_date": "2026-10-30"
        },
        "no_enforcing_dmarc": {
          "label": "DMARC absent or not enforcing quarantine/reject",
          "count": 15,
          "denominator": 38,
          "percent": 39,
          "unknown": 0,
          "population": 38,
          "run_date": "2026-10-30"
        },
        "spf_missing_or_soft": {
          "label": "SPF missing, invalid, soft, neutral or permissive",
          "count": 29,
          "denominator": 37,
          "percent": 78,
          "unknown": 1,
          "population": 38,
          "run_date": "2026-10-30"
        },
        "no_csp": {
          "label": "No enforced Content-Security-Policy header",
          "count": 22,
          "denominator": 38,
          "percent": 58,
          "unknown": 0,
          "population": 38,
          "run_date": "2026-10-30"
        },
        "no_hsts": {
          "label": "No positive HSTS max-age",
          "count": 5,
          "denominator": 38,
          "percent": 13,
          "unknown": 0,
          "population": 38,
          "run_date": "2026-10-30"
        },
        "clickjacking_unprotected": {
          "label": "No recognised framing protection",
          "count": 15,
          "denominator": 38,
          "percent": 39,
          "unknown": 0,
          "population": 38,
          "run_date": "2026-10-30"
        },
        "env_exposed": {
          "label": "Public .env signature confirmed",
          "count": 0,
          "denominator": 20,
          "percent": 0,
          "unknown": 18,
          "population": 38,
          "run_date": "2026-10-30"
        },
        "git_exposed": {
          "label": "Public .git/HEAD signature confirmed",
          "count": 0,
          "denominator": 20,
          "percent": 0,
          "unknown": 18,
          "population": 38,
          "run_date": "2026-10-30"
        },
        "sensitive_paths_exposed": {
          "label": "Sensitive file content confirmed in path probes",
          "count": 2,
          "denominator": 8,
          "percent": 25,
          "unknown": 30,
          "population": 38,
          "run_date": "2026-10-30"
        },
        "exposed_env_git_or_files": {
          "label": "Public .env, .git or sensitive file content confirmed",
          "count": 2,
          "denominator": 6,
          "percent": 33,
          "unknown": 32,
          "population": 38,
          "run_date": "2026-10-30"
        },
        "header_disclosure": {
          "label": "Server version or software-identifying header visible",
          "count": 10,
          "denominator": 38,
          "percent": 26,
          "unknown": 0,
          "population": 38,
          "run_date": "2026-10-30"
        },
        "exact_versions_visible": {
          "label": "Exact software version visible in page or headers",
          "count": 7,
          "denominator": 38,
          "percent": 18,
          "unknown": 0,
          "population": 38,
          "run_date": "2026-10-30"
        },
        "securitytxt_present": {
          "label": "security.txt with a Contact line found",
          "count": 4,
          "denominator": 37,
          "percent": 11,
          "unknown": 1,
          "population": 38,
          "run_date": "2026-10-30"
        },
        "legacy_tls_accepted": {
          "label": "TLS 1.0 or 1.1 handshake accepted",
          "count": 5,
          "denominator": 38,
          "percent": 13,
          "unknown": 0,
          "population": 38,
          "run_date": "2026-10-30"
        },
        "cookies_without_secure": {
          "label": "Home page sets a cookie without Secure",
          "count": 2,
          "denominator": 38,
          "percent": 5,
          "unknown": 0,
          "population": 38,
          "run_date": "2026-10-30"
        },
        "cookies_without_httponly": {
          "label": "Home page sets a cookie without HttpOnly",
          "count": 3,
          "denominator": 38,
          "percent": 8,
          "unknown": 0,
          "population": 38,
          "run_date": "2026-10-30"
        },
        "cookies_missing_either_flag": {
          "label": "Home page sets a cookie without Secure or HttpOnly",
          "count": 4,
          "denominator": 38,
          "percent": 11,
          "unknown": 0,
          "population": 38,
          "run_date": "2026-10-30"
        },
        "cookie_setters_missing_either_flag": {
          "label": "Cookie-setting home pages missing Secure or HttpOnly",
          "count": 4,
          "denominator": 16,
          "percent": 25,
          "unknown": 22,
          "population": 38,
          "run_date": "2026-10-30"
        },
        "at_least_one_fail": {
          "label": "At least one observed fail",
          "count": 29,
          "denominator": 38,
          "percent": 76,
          "unknown": 0,
          "population": 38,
          "run_date": "2026-10-30"
        }
      },
      "checks": {
        "https": {
          "title": "HTTPS works",
          "group": "https",
          "run_date": "2026-10-30",
          "population": 38,
          "denominator": 38,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 38,
            "warn": 0,
            "fail": 0
          },
          "status_percent": {
            "pass": 100,
            "warn": 0,
            "fail": 0
          },
          "fix": "Install a free certificate (Let\u2019s Encrypt, or your host\u2019s one-click SSL) and serve the whole site over HTTPS."
        },
        "redirect": {
          "title": "Plain HTTP redirects to HTTPS",
          "group": "https",
          "run_date": "2026-10-30",
          "population": 38,
          "denominator": 38,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 36,
            "warn": 0,
            "fail": 2
          },
          "status_percent": {
            "pass": 95,
            "warn": 0,
            "fail": 5
          },
          "fix": "Add a permanent (301) redirect from every http:// address to the same https:// address."
        },
        "hsts": {
          "title": "Browsers are told to always use HTTPS (HSTS)",
          "group": "https",
          "run_date": "2026-10-30",
          "population": 38,
          "denominator": 38,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 33,
            "warn": 0,
            "fail": 5
          },
          "status_percent": {
            "pass": 87,
            "warn": 0,
            "fail": 13
          },
          "fix": "Add the header Strict-Transport-Security: max-age=31536000; includeSubDomains"
        },
        "cert": {
          "title": "Certificate is valid and not about to expire",
          "group": "https",
          "run_date": "2026-10-30",
          "population": 38,
          "denominator": 38,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 38,
            "warn": 0,
            "fail": 0
          },
          "status_percent": {
            "pass": 100,
            "warn": 0,
            "fail": 0
          },
          "fix": "Renew it now and switch on automatic renewal so it never lapses."
        },
        "csp": {
          "title": "Content Security Policy limits what can run",
          "group": "headers",
          "run_date": "2026-10-30",
          "population": 38,
          "denominator": 38,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 12,
            "warn": 5,
            "fail": 21
          },
          "status_percent": {
            "pass": 32,
            "warn": 13,
            "fail": 55
          },
          "fix": "Start with Content-Security-Policy: default-src 'self' and add the sources your site really uses."
        },
        "framing": {
          "title": "Protected against clickjacking",
          "group": "headers",
          "run_date": "2026-10-30",
          "population": 38,
          "denominator": 38,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 23,
            "warn": 0,
            "fail": 15
          },
          "status_percent": {
            "pass": 61,
            "warn": 0,
            "fail": 39
          },
          "fix": "Add X-Frame-Options: DENY (or frame-ancestors 'none' in your CSP)."
        },
        "nosniff": {
          "title": "Browsers will not guess file types",
          "group": "headers",
          "run_date": "2026-10-30",
          "population": 38,
          "denominator": 38,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 18,
            "warn": 0,
            "fail": 20
          },
          "status_percent": {
            "pass": 47,
            "warn": 0,
            "fail": 53
          },
          "fix": "Add the header X-Content-Type-Options: nosniff"
        },
        "referrer": {
          "title": "Page addresses are not leaked to other sites",
          "group": "headers",
          "run_date": "2026-10-30",
          "population": 38,
          "denominator": 38,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 16,
            "warn": 22,
            "fail": 0
          },
          "status_percent": {
            "pass": 42,
            "warn": 58,
            "fail": 0
          },
          "fix": "Add the header Referrer-Policy: strict-origin-when-cross-origin"
        },
        "permissions": {
          "title": "Camera, microphone and location are locked down",
          "group": "headers",
          "run_date": "2026-10-30",
          "population": 38,
          "denominator": 38,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 10,
            "warn": 28,
            "fail": 0
          },
          "status_percent": {
            "pass": 26,
            "warn": 74,
            "fail": 0
          },
          "fix": "Add Permissions-Policy: camera=(), microphone=(), geolocation=()"
        },
        "spf": {
          "title": "SPF says who may send email as you",
          "group": "email",
          "run_date": "2026-10-30",
          "population": 38,
          "denominator": 37,
          "unknown_or_inapplicable": 1,
          "status_counts": {
            "pass": 34,
            "warn": 0,
            "fail": 3
          },
          "status_percent": {
            "pass": 92,
            "warn": 0,
            "fail": 8
          },
          "fix": "Publish a TXT record such as v=spf1 include:<your email provider> -all"
        },
        "dmarc": {
          "title": "DMARC tells receivers to block fake emails",
          "group": "email",
          "run_date": "2026-10-30",
          "population": 38,
          "denominator": 38,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 23,
            "warn": 13,
            "fail": 2
          },
          "status_percent": {
            "pass": 61,
            "warn": 34,
            "fail": 5
          },
          "fix": "After checking the reports, move to p=quarantine and then p=reject."
        },
        "git": {
          "title": "Source code history is not public",
          "group": "exposure",
          "run_date": "2026-10-30",
          "population": 38,
          "denominator": 20,
          "unknown_or_inapplicable": 18,
          "status_counts": {
            "pass": 20,
            "warn": 0,
            "fail": 0
          },
          "status_percent": {
            "pass": 100,
            "warn": 0,
            "fail": 0
          },
          "fix": "Block access to /.git on the web server (or deploy without it) today, then change any secrets that were in the code."
        },
        "env": {
          "title": "Secrets file (.env) is not public",
          "group": "exposure",
          "run_date": "2026-10-30",
          "population": 38,
          "denominator": 20,
          "unknown_or_inapplicable": 18,
          "status_counts": {
            "pass": 20,
            "warn": 0,
            "fail": 0
          },
          "status_percent": {
            "pass": 100,
            "warn": 0,
            "fail": 0
          },
          "fix": "Remove it from the web folder or block it on the server now, then change every secret it contains."
        },
        "versions": {
          "title": "Software versions are not advertised",
          "group": "exposure",
          "run_date": "2026-10-30",
          "population": 38,
          "denominator": 38,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 28,
            "warn": 10,
            "fail": 0
          },
          "status_percent": {
            "pass": 74,
            "warn": 26,
            "fail": 0
          },
          "fix": "Hide version numbers in the web server and framework settings (e.g. ServerTokens Prod, expose_php = Off)."
        },
        "cookies": {
          "title": "Cookies are protected",
          "group": "exposure",
          "run_date": "2026-10-30",
          "population": 38,
          "denominator": 38,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 34,
            "warn": 2,
            "fail": 2
          },
          "status_percent": {
            "pass": 89,
            "warn": 5,
            "fail": 5
          },
          "fix": "Set Secure on every cookie (and HttpOnly and SameSite where scripts don\u2019t need them)."
        },
        "securitytxt": {
          "title": "Security contact is published",
          "group": "exposure",
          "run_date": "2026-10-30",
          "population": 38,
          "denominator": 37,
          "unknown_or_inapplicable": 1,
          "status_counts": {
            "pass": 4,
            "warn": 33,
            "fail": 0
          },
          "status_percent": {
            "pass": 11,
            "warn": 89,
            "fail": 0
          },
          "fix": "Publish /.well-known/security.txt with a Contact: line and an Expires: date (see securitytxt.org)."
        },
        "tlsver": {
          "title": "Only modern TLS versions are accepted",
          "group": "tls",
          "run_date": "2026-10-30",
          "population": 38,
          "denominator": 38,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 33,
            "warn": 0,
            "fail": 5
          },
          "status_percent": {
            "pass": 87,
            "warn": 0,
            "fail": 13
          },
          "fix": "Disable TLS 1.0 and 1.1 on the web server or load balancer, keeping TLS 1.2 and 1.3."
        },
        "cipher": {
          "title": "Strong cipher negotiated",
          "group": "tls",
          "run_date": "2026-10-30",
          "population": 38,
          "denominator": 38,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 38,
            "warn": 0,
            "fail": 0
          },
          "status_percent": {
            "pass": 100,
            "warn": 0,
            "fail": 0
          },
          "fix": "Prefer AES-GCM or ChaCha20 cipher suites and remove RC4, 3DES and CBC-SHA suites."
        },
        "certsig": {
          "title": "Certificate uses a modern signature",
          "group": "tls",
          "run_date": "2026-10-30",
          "population": 38,
          "denominator": 38,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 38,
            "warn": 0,
            "fail": 0
          },
          "status_percent": {
            "pass": 100,
            "warn": 0,
            "fail": 0
          },
          "fix": "Reissue the certificate; any current certificate authority uses SHA-256."
        },
        "subdomains": {
          "title": "No forgotten subdomains",
          "group": "surface",
          "run_date": "2026-10-30",
          "population": 38,
          "denominator": 15,
          "unknown_or_inapplicable": 23,
          "status_counts": {
            "pass": 0,
            "warn": 15,
            "fail": 0
          },
          "status_percent": {
            "pass": 0,
            "warn": 100,
            "fail": 0
          },
          "fix": "Confirm each one is meant to be public. Take down what is not needed; put the rest behind a VPN or login and keep it patched."
        },
        "paths": {
          "title": "No admin pages or sensitive files reachable",
          "group": "surface",
          "run_date": "2026-10-30",
          "population": 38,
          "denominator": 8,
          "unknown_or_inapplicable": 30,
          "status_counts": {
            "pass": 4,
            "warn": 2,
            "fail": 2
          },
          "status_percent": {
            "pass": 50,
            "warn": 25,
            "fail": 25
          },
          "fix": "Remove these files from the web folder or block them on the server. Backups and logs belong outside the site entirely."
        },
        "tech": {
          "title": "Software versions are not advertised on the page",
          "group": "software",
          "run_date": "2026-10-30",
          "population": 38,
          "denominator": 38,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 31,
            "warn": 7,
            "fail": 0
          },
          "status_percent": {
            "pass": 82,
            "warn": 18,
            "fail": 0
          },
          "fix": "Remove generator tags and ?ver= query strings from page output (most platforms have a setting or plugin for it), and keep the software updated."
        },
        "wpapi": {
          "title": "WordPress user list is not public",
          "group": "software",
          "run_date": "2026-10-30",
          "population": 38,
          "denominator": 5,
          "unknown_or_inapplicable": 33,
          "status_counts": {
            "pass": 4,
            "warn": 0,
            "fail": 1
          },
          "status_percent": {
            "pass": 80,
            "warn": 0,
            "fail": 20
          },
          "fix": "Restrict the REST users endpoint to logged-in users (a one-line filter or a security plugin), and use two-factor sign-in."
        },
        "cors": {
          "title": "Other websites cannot read your pages",
          "group": "api",
          "run_date": "2026-10-30",
          "population": 38,
          "denominator": 38,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 27,
            "warn": 11,
            "fail": 0
          },
          "status_percent": {
            "pass": 71,
            "warn": 29,
            "fail": 0
          },
          "fix": "Allow only the specific origins that need access, and never combine * with credentials."
        },
        "samesite": {
          "title": "Cookies are protected from cross-site requests",
          "group": "api",
          "run_date": "2026-10-30",
          "population": 38,
          "denominator": 38,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 37,
            "warn": 1,
            "fail": 0
          },
          "status_percent": {
            "pass": 97,
            "warn": 3,
            "fail": 0
          },
          "fix": "Add SameSite=Lax (or Strict) to every cookie."
        }
      }
    },
    "ai": {
      "attempted": 99,
      "checked": 94,
      "could_not_check": 5,
      "could_not_check_reasons": {
        "access_denied": 1,
        "dns_or_offline": 3,
        "firewall_challenge": 1
      },
      "run_date": "2026-10-30",
      "median_score": 76.0,
      "grades": {
        "A": {
          "count": 7,
          "denominator": 94,
          "percent": 7,
          "unknown": 0,
          "population": 94,
          "run_date": "2026-10-30"
        },
        "B": {
          "count": 43,
          "denominator": 94,
          "percent": 46,
          "unknown": 0,
          "population": 94,
          "run_date": "2026-10-30"
        },
        "C": {
          "count": 36,
          "denominator": 94,
          "percent": 38,
          "unknown": 0,
          "population": 94,
          "run_date": "2026-10-30"
        },
        "D": {
          "count": 8,
          "denominator": 94,
          "percent": 9,
          "unknown": 0,
          "population": 94,
          "run_date": "2026-10-30"
        },
        "E": {
          "count": 0,
          "denominator": 94,
          "percent": 0,
          "unknown": 0,
          "population": 94,
          "run_date": "2026-10-30"
        },
        "F": {
          "count": 0,
          "denominator": 94,
          "percent": 0,
          "unknown": 0,
          "population": 94,
          "run_date": "2026-10-30"
        }
      },
      "metrics": {
        "no_dmarc_policy": {
          "label": "No valid DMARC policy found",
          "count": 8,
          "denominator": 94,
          "percent": 9,
          "unknown": 0,
          "population": 94,
          "run_date": "2026-10-30"
        },
        "no_enforcing_dmarc": {
          "label": "DMARC absent or not enforcing quarantine/reject",
          "count": 41,
          "denominator": 94,
          "percent": 44,
          "unknown": 0,
          "population": 94,
          "run_date": "2026-10-30"
        },
        "spf_missing_or_soft": {
          "label": "SPF missing, invalid, soft, neutral or permissive",
          "count": 75,
          "denominator": 91,
          "percent": 82,
          "unknown": 3,
          "population": 94,
          "run_date": "2026-10-30"
        },
        "no_csp": {
          "label": "No enforced Content-Security-Policy header",
          "count": 55,
          "denominator": 94,
          "percent": 59,
          "unknown": 0,
          "population": 94,
          "run_date": "2026-10-30"
        },
        "no_hsts": {
          "label": "No positive HSTS max-age",
          "count": 22,
          "denominator": 94,
          "percent": 23,
          "unknown": 0,
          "population": 94,
          "run_date": "2026-10-30"
        },
        "clickjacking_unprotected": {
          "label": "No recognised framing protection",
          "count": 48,
          "denominator": 94,
          "percent": 51,
          "unknown": 0,
          "population": 94,
          "run_date": "2026-10-30"
        },
        "env_exposed": {
          "label": "Public .env signature confirmed",
          "count": 0,
          "denominator": 53,
          "percent": 0,
          "unknown": 41,
          "population": 94,
          "run_date": "2026-10-30"
        },
        "git_exposed": {
          "label": "Public .git/HEAD signature confirmed",
          "count": 0,
          "denominator": 53,
          "percent": 0,
          "unknown": 41,
          "population": 94,
          "run_date": "2026-10-30"
        },
        "sensitive_paths_exposed": {
          "label": "Sensitive file content confirmed in path probes",
          "count": 2,
          "denominator": 23,
          "percent": 9,
          "unknown": 71,
          "population": 94,
          "run_date": "2026-10-30"
        },
        "exposed_env_git_or_files": {
          "label": "Public .env, .git or sensitive file content confirmed",
          "count": 2,
          "denominator": 19,
          "percent": 11,
          "unknown": 75,
          "population": 94,
          "run_date": "2026-10-30"
        },
        "header_disclosure": {
          "label": "Server version or software-identifying header visible",
          "count": 31,
          "denominator": 94,
          "percent": 33,
          "unknown": 0,
          "population": 94,
          "run_date": "2026-10-30"
        },
        "exact_versions_visible": {
          "label": "Exact software version visible in page or headers",
          "count": 19,
          "denominator": 94,
          "percent": 20,
          "unknown": 0,
          "population": 94,
          "run_date": "2026-10-30"
        },
        "securitytxt_present": {
          "label": "security.txt with a Contact line found",
          "count": 6,
          "denominator": 90,
          "percent": 7,
          "unknown": 4,
          "population": 94,
          "run_date": "2026-10-30"
        },
        "legacy_tls_accepted": {
          "label": "TLS 1.0 or 1.1 handshake accepted",
          "count": 8,
          "denominator": 92,
          "percent": 9,
          "unknown": 2,
          "population": 94,
          "run_date": "2026-10-30"
        },
        "cookies_without_secure": {
          "label": "Home page sets a cookie without Secure",
          "count": 9,
          "denominator": 94,
          "percent": 10,
          "unknown": 0,
          "population": 94,
          "run_date": "2026-10-30"
        },
        "cookies_without_httponly": {
          "label": "Home page sets a cookie without HttpOnly",
          "count": 10,
          "denominator": 94,
          "percent": 11,
          "unknown": 0,
          "population": 94,
          "run_date": "2026-10-30"
        },
        "cookies_missing_either_flag": {
          "label": "Home page sets a cookie without Secure or HttpOnly",
          "count": 10,
          "denominator": 94,
          "percent": 11,
          "unknown": 0,
          "population": 94,
          "run_date": "2026-10-30"
        },
        "cookie_setters_missing_either_flag": {
          "label": "Cookie-setting home pages missing Secure or HttpOnly",
          "count": 10,
          "denominator": 37,
          "percent": 27,
          "unknown": 57,
          "population": 94,
          "run_date": "2026-10-30"
        },
        "at_least_one_fail": {
          "label": "At least one observed fail",
          "count": 79,
          "denominator": 94,
          "percent": 84,
          "unknown": 0,
          "population": 94,
          "run_date": "2026-10-30"
        }
      },
      "checks": {
        "https": {
          "title": "HTTPS works",
          "group": "https",
          "run_date": "2026-10-30",
          "population": 94,
          "denominator": 94,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 94,
            "warn": 0,
            "fail": 0
          },
          "status_percent": {
            "pass": 100,
            "warn": 0,
            "fail": 0
          },
          "fix": "Install a free certificate (Let\u2019s Encrypt, or your host\u2019s one-click SSL) and serve the whole site over HTTPS."
        },
        "redirect": {
          "title": "Plain HTTP redirects to HTTPS",
          "group": "https",
          "run_date": "2026-10-30",
          "population": 94,
          "denominator": 91,
          "unknown_or_inapplicable": 3,
          "status_counts": {
            "pass": 91,
            "warn": 0,
            "fail": 0
          },
          "status_percent": {
            "pass": 100,
            "warn": 0,
            "fail": 0
          },
          "fix": "Add a permanent (301) redirect from every http:// address to the same https:// address."
        },
        "hsts": {
          "title": "Browsers are told to always use HTTPS (HSTS)",
          "group": "https",
          "run_date": "2026-10-30",
          "population": 94,
          "denominator": 94,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 70,
            "warn": 2,
            "fail": 22
          },
          "status_percent": {
            "pass": 74,
            "warn": 2,
            "fail": 23
          },
          "fix": "Add the header Strict-Transport-Security: max-age=31536000; includeSubDomains"
        },
        "cert": {
          "title": "Certificate is valid and not about to expire",
          "group": "https",
          "run_date": "2026-10-30",
          "population": 94,
          "denominator": 94,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 94,
            "warn": 0,
            "fail": 0
          },
          "status_percent": {
            "pass": 100,
            "warn": 0,
            "fail": 0
          },
          "fix": "Renew it now and switch on automatic renewal so it never lapses."
        },
        "csp": {
          "title": "Content Security Policy limits what can run",
          "group": "headers",
          "run_date": "2026-10-30",
          "population": 94,
          "denominator": 94,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 31,
            "warn": 12,
            "fail": 51
          },
          "status_percent": {
            "pass": 33,
            "warn": 13,
            "fail": 54
          },
          "fix": "Start with Content-Security-Policy: default-src 'self' and add the sources your site really uses."
        },
        "framing": {
          "title": "Protected against clickjacking",
          "group": "headers",
          "run_date": "2026-10-30",
          "population": 94,
          "denominator": 94,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 46,
            "warn": 0,
            "fail": 48
          },
          "status_percent": {
            "pass": 49,
            "warn": 0,
            "fail": 51
          },
          "fix": "Add X-Frame-Options: DENY (or frame-ancestors 'none' in your CSP)."
        },
        "nosniff": {
          "title": "Browsers will not guess file types",
          "group": "headers",
          "run_date": "2026-10-30",
          "population": 94,
          "denominator": 94,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 39,
            "warn": 0,
            "fail": 55
          },
          "status_percent": {
            "pass": 41,
            "warn": 0,
            "fail": 59
          },
          "fix": "Add the header X-Content-Type-Options: nosniff"
        },
        "referrer": {
          "title": "Page addresses are not leaked to other sites",
          "group": "headers",
          "run_date": "2026-10-30",
          "population": 94,
          "denominator": 94,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 30,
            "warn": 64,
            "fail": 0
          },
          "status_percent": {
            "pass": 32,
            "warn": 68,
            "fail": 0
          },
          "fix": "Add the header Referrer-Policy: strict-origin-when-cross-origin"
        },
        "permissions": {
          "title": "Camera, microphone and location are locked down",
          "group": "headers",
          "run_date": "2026-10-30",
          "population": 94,
          "denominator": 94,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 17,
            "warn": 77,
            "fail": 0
          },
          "status_percent": {
            "pass": 18,
            "warn": 82,
            "fail": 0
          },
          "fix": "Add Permissions-Policy: camera=(), microphone=(), geolocation=()"
        },
        "spf": {
          "title": "SPF says who may send email as you",
          "group": "email",
          "run_date": "2026-10-30",
          "population": 94,
          "denominator": 91,
          "unknown_or_inapplicable": 3,
          "status_counts": {
            "pass": 80,
            "warn": 1,
            "fail": 10
          },
          "status_percent": {
            "pass": 88,
            "warn": 1,
            "fail": 11
          },
          "fix": "Publish a TXT record such as v=spf1 include:<your email provider> -all"
        },
        "dmarc": {
          "title": "DMARC tells receivers to block fake emails",
          "group": "email",
          "run_date": "2026-10-30",
          "population": 94,
          "denominator": 94,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 53,
            "warn": 33,
            "fail": 8
          },
          "status_percent": {
            "pass": 56,
            "warn": 35,
            "fail": 9
          },
          "fix": "After checking the reports, move to p=quarantine and then p=reject."
        },
        "git": {
          "title": "Source code history is not public",
          "group": "exposure",
          "run_date": "2026-10-30",
          "population": 94,
          "denominator": 53,
          "unknown_or_inapplicable": 41,
          "status_counts": {
            "pass": 53,
            "warn": 0,
            "fail": 0
          },
          "status_percent": {
            "pass": 100,
            "warn": 0,
            "fail": 0
          },
          "fix": "Block access to /.git on the web server (or deploy without it) today, then change any secrets that were in the code."
        },
        "env": {
          "title": "Secrets file (.env) is not public",
          "group": "exposure",
          "run_date": "2026-10-30",
          "population": 94,
          "denominator": 53,
          "unknown_or_inapplicable": 41,
          "status_counts": {
            "pass": 53,
            "warn": 0,
            "fail": 0
          },
          "status_percent": {
            "pass": 100,
            "warn": 0,
            "fail": 0
          },
          "fix": "Remove it from the web folder or block it on the server now, then change every secret it contains."
        },
        "versions": {
          "title": "Software versions are not advertised",
          "group": "exposure",
          "run_date": "2026-10-30",
          "population": 94,
          "denominator": 94,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 63,
            "warn": 31,
            "fail": 0
          },
          "status_percent": {
            "pass": 67,
            "warn": 33,
            "fail": 0
          },
          "fix": "Hide version numbers in the web server and framework settings (e.g. ServerTokens Prod, expose_php = Off)."
        },
        "cookies": {
          "title": "Cookies are protected",
          "group": "exposure",
          "run_date": "2026-10-30",
          "population": 94,
          "denominator": 94,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 84,
            "warn": 1,
            "fail": 9
          },
          "status_percent": {
            "pass": 89,
            "warn": 1,
            "fail": 10
          },
          "fix": "Set Secure on every cookie (and HttpOnly and SameSite where scripts don\u2019t need them)."
        },
        "securitytxt": {
          "title": "Security contact is published",
          "group": "exposure",
          "run_date": "2026-10-30",
          "population": 94,
          "denominator": 90,
          "unknown_or_inapplicable": 4,
          "status_counts": {
            "pass": 6,
            "warn": 84,
            "fail": 0
          },
          "status_percent": {
            "pass": 7,
            "warn": 93,
            "fail": 0
          },
          "fix": "Publish /.well-known/security.txt with a Contact: line and an Expires: date (see securitytxt.org)."
        },
        "tlsver": {
          "title": "Only modern TLS versions are accepted",
          "group": "tls",
          "run_date": "2026-10-30",
          "population": 94,
          "denominator": 92,
          "unknown_or_inapplicable": 2,
          "status_counts": {
            "pass": 84,
            "warn": 0,
            "fail": 8
          },
          "status_percent": {
            "pass": 91,
            "warn": 0,
            "fail": 9
          },
          "fix": "Disable TLS 1.0 and 1.1 on the web server or load balancer, keeping TLS 1.2 and 1.3."
        },
        "cipher": {
          "title": "Strong cipher negotiated",
          "group": "tls",
          "run_date": "2026-10-30",
          "population": 94,
          "denominator": 94,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 94,
            "warn": 0,
            "fail": 0
          },
          "status_percent": {
            "pass": 100,
            "warn": 0,
            "fail": 0
          },
          "fix": "Prefer AES-GCM or ChaCha20 cipher suites and remove RC4, 3DES and CBC-SHA suites."
        },
        "certsig": {
          "title": "Certificate uses a modern signature",
          "group": "tls",
          "run_date": "2026-10-30",
          "population": 94,
          "denominator": 94,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 94,
            "warn": 0,
            "fail": 0
          },
          "status_percent": {
            "pass": 100,
            "warn": 0,
            "fail": 0
          },
          "fix": "Reissue the certificate; any current certificate authority uses SHA-256."
        },
        "subdomains": {
          "title": "No forgotten subdomains",
          "group": "surface",
          "run_date": "2026-10-30",
          "population": 94,
          "denominator": 44,
          "unknown_or_inapplicable": 50,
          "status_counts": {
            "pass": 2,
            "warn": 42,
            "fail": 0
          },
          "status_percent": {
            "pass": 5,
            "warn": 95,
            "fail": 0
          },
          "fix": "Confirm each one is meant to be public. Take down what is not needed; put the rest behind a VPN or login and keep it patched."
        },
        "paths": {
          "title": "No admin pages or sensitive files reachable",
          "group": "surface",
          "run_date": "2026-10-30",
          "population": 94,
          "denominator": 23,
          "unknown_or_inapplicable": 71,
          "status_counts": {
            "pass": 18,
            "warn": 3,
            "fail": 2
          },
          "status_percent": {
            "pass": 78,
            "warn": 13,
            "fail": 9
          },
          "fix": "Remove these files from the web folder or block them on the server. Backups and logs belong outside the site entirely."
        },
        "tech": {
          "title": "Software versions are not advertised on the page",
          "group": "software",
          "run_date": "2026-10-30",
          "population": 94,
          "denominator": 94,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 75,
            "warn": 19,
            "fail": 0
          },
          "status_percent": {
            "pass": 80,
            "warn": 20,
            "fail": 0
          },
          "fix": "Remove generator tags and ?ver= query strings from page output (most platforms have a setting or plugin for it), and keep the software updated."
        },
        "wpapi": {
          "title": "WordPress user list is not public",
          "group": "software",
          "run_date": "2026-10-30",
          "population": 94,
          "denominator": 7,
          "unknown_or_inapplicable": 87,
          "status_counts": {
            "pass": 3,
            "warn": 0,
            "fail": 4
          },
          "status_percent": {
            "pass": 43,
            "warn": 0,
            "fail": 57
          },
          "fix": "Restrict the REST users endpoint to logged-in users (a one-line filter or a security plugin), and use two-factor sign-in."
        },
        "cors": {
          "title": "Other websites cannot read your pages",
          "group": "api",
          "run_date": "2026-10-30",
          "population": 94,
          "denominator": 94,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 74,
            "warn": 20,
            "fail": 0
          },
          "status_percent": {
            "pass": 79,
            "warn": 21,
            "fail": 0
          },
          "fix": "Allow only the specific origins that need access, and never combine * with credentials."
        },
        "samesite": {
          "title": "Cookies are protected from cross-site requests",
          "group": "api",
          "run_date": "2026-10-30",
          "population": 94,
          "denominator": 94,
          "unknown_or_inapplicable": 0,
          "status_counts": {
            "pass": 91,
            "warn": 3,
            "fail": 0
          },
          "status_percent": {
            "pass": 97,
            "warn": 3,
            "fail": 0
          },
          "fix": "Add SameSite=Lax (or Strict) to every cookie."
        }
      }
    }
  }
}