What we check

CyberVigil looks at your business from the outside, the way a customer's browser or an email provider would. We only read information your website and domain already publish. This page lists every check, how the score works, and where the limits are.

How does a CyberVigil check work?

We run four groups of checks at the same time: website, email, domain, and reputation. Your report fills in as each group finishes, usually within seconds.

• Website checks request your homepage over HTTPS and plain HTTP, and open an encrypted connection to read your certificate.
• Email and domain checks read public DNS records using DNS-over-HTTPS from Cloudflare, with Google Public DNS as a backup.
• Reputation checks compare your domain against public blocklists.

We check the exact address you enter for website settings, and your main domain for email and domain settings. If you enter shop.yourbusiness.com, we load that site and check email records for yourbusiness.com.

Website checks

• A certificate with fewer than 21 days left gets a warning. One that is expired, untrusted, issued for a different address, or 7 or fewer days from expiry fails.
• For headers, "sensible values" means HSTS lasts at least six months, X-Content-Type-Options is nosniff, framing is DENY or SAMEORIGIN (or uses frame-ancestors), and Referrer-Policy isn't unsafe-url. Two to five headers is a warning. Zero or one fails.
• The old TLS version test is best-effort, so "not detected" isn't definitive.

Email checks

If your domain doesn't receive email, a missing SPF record is a warning rather than a failure. A DMARC policy of p=none is "monitoring only" and gets a warning, since fake emails are reported but not blocked.

DKIM selectors can't be listed from outside, so we try common names. If we don't find one, the result is informational and doesn't lower your score. Confirm DKIM in your email provider's admin settings.

Domain and reputation checks

Phishing.Database is an open, MIT-licensed community list of active phishing domains. We refresh our copy at most every six hours. Your report always names which lists were checked for your domain.

How is the score calculated?

Every report starts at 100. Each check that needs attention subtracts points based on its result and its severity. Informational results and checks we couldn't complete subtract nothing. The score never goes below 0 or above 100.

Three failures carry heavier deductions because they affect every visitor or every email:

Your score then falls into one of four bands:

For example, a site where everything passes except a DMARC policy set to monitoring only would score 95. That warning is medium severity, so it subtracts 5 points.

What does the score mean, and what doesn't it?

The score shows how closely your public settings match widely recommended practice at the moment we checked. Use it to decide what to fix first and to track progress.

It doesn't mean your business is safe from attack, and a perfect score doesn't make you compliant with any law, standard, or insurance requirement. It says nothing about your passwords, devices, staff training, or backups.

A low score usually means settings are missing, not that you've been hacked. The exception is a blocklist listing, which often means a site was compromised.

What doesn't CyberVigil check?

Our checks are deliberately limited to what's public. We do not:

• Scan ports. We only connect on the standard web ports, 80 and 443.
• Log in, guess passwords, or submit forms on your site.
• Scan files on your server for malware.
• Try to exploit vulnerabilities or send attack payloads.
• Crawl your site. We load the homepage only.
• Look at your internal network, devices, Wi-Fi, or staff accounts.
• Check whether you use multi-factor authentication, keep backups, or update plugins.

CyberVigil is not a penetration test or a security audit. For the parts we can't see from outside, work through our small business cybersecurity checklist.

How does the AI summary work?

After your score is calculated, an AI model writes the short summary at the top of your report. We reach it through Vercel AI Gateway, and today it's Google Gemini 2.5 Flash by default.

The model receives your domain, score, band, detected providers and platform, and each check's name, result, severity, description, and estimated effort. It doesn't receive your email address, IP address, or anything else about you.

The summary has these guardrails:

• It may discuss only the findings provided, and must never invent problems, numbers, or vendors.
• Its answer must fit a fixed structure and can only point to findings that need attention.
• An automatic filter rejects wording like "guaranteed", "unhackable", or "compliant".
• If the answer breaks a rule, takes over 20 seconds, or the model is unavailable, we use a written template built from the same results.
• It's labeled "AI-powered insights" only when AI wrote it. Otherwise it's labeled "Your summary".

The AI never sets your score or changes a check result.

Is it safe to run on my website?

Yes. Our checks are passive and read only what's already public. A full check makes a handful of requests to your site: one homepage request over HTTPS and one over HTTP (following up to five redirects), plus a few encrypted connections on port 443 to read your certificate and test old TLS versions. Everything else is DNS and blocklist lookups.

We only download HTML or plain text, up to 512 KB, and stop waiting after 8 seconds. Our requests use this user agent, so you'll recognize them in your logs:

CyberVigilBot/1.0 (+https://cybervigil.ai/what-we-check)

We also guard against misuse. We accept public domain names only, not IP addresses, and connect only over http or https on ports 80 and 443. We refuse any address, including every redirect, that points to a private or internal network. Checks are rate limited per visitor, and we may ask for a quick human check (Cloudflare Turnstile).

How fresh are the results?

Each report is a snapshot from the time shown on it. If the same domain was checked in the last 10 minutes, we show that recent report instead of running a new one, which keeps the load on your site low.

After you fix something, use Re-check on your report. It always runs a fresh check and compares the results with your last one. DNS changes can take minutes to hours to show up, and blocklist data may be up to six hours old.

How do I report a mistake?

If you think a result is wrong, email hello@cybervigil.ai with your report link and what you expected to see. We'll fix the check if we got it wrong. The same address works for questions about CyberVigilBot in your logs.

To see what a report looks like, run a free check or open an example report.