Docs
Scanner rules and scoring
Defexity runs 130+ read-only checks on a public URL. Each finding includes evidence, a confidence level, the risk, a recommended fix and a copy-paste prompt for your AI coding tool.
How scoring works
- security40%
- reliability20%
- Privacy / Legal15%
- accessibility10%
- SEO / Quality10%
- performance5%
Each category starts at 100. Open findings deduct 20 (critical), 10 (high), 5 (medium) or 2 (low) points; low-confidence findings count for half. A category can lose at most 80 points, and any open critical finding keeps the overall score at or below 59. Ignored and resolved findings stop counting.
Secrets, HTTPS and security headers
- REL-001Site is unreachable or returns an errorCritical
- SEC-001Site is not served over HTTPSCritical
- SEC-002HTTP does not redirect to HTTPSHigh
- SEC-003TLS certificate problemCritical
- SEC-004Missing or weak Strict-Transport-Security headerMedium
- SEC-005Content-Security-Policy missing or permissiveMedium
- SEC-006Missing X-Content-Type-Options: nosniffLow
- SEC-007No clickjacking protectionMedium
- SEC-008Referrer-Policy leaks full URLsLow
- SEC-009Permissions-Policy uses an ignored syntaxLow
- SEC-010Server software version disclosedLow
- SEC-011Session cookie set without Secure or HttpOnlyMedium
- SEC-012Environment file publicly accessibleCritical
- SEC-013Git repository metadata publicly accessibleHigh
- SEC-014Sensitive file publicly accessibleHigh
- SEC-015JavaScript source maps are publicLow
- SEC-016Secret key exposed in public HTML or JavaScriptCritical
- SEC-017Database credentials exposed to the browserCritical
- SEC-018Error page leaks stack traces or internalsMedium
- SEC-019API route returns data without authenticationHigh
- SEC-020Browser calls an AI provider API directlyHigh
- SEC-021AI endpoint shows no sign of auth or rate limitingMedium
- SEC-022HTTPS page loads insecure http:// resourcesMedium
- SEC-052No security.txt for reporting vulnerabilitiesLow
- SEC-023CORS trusts any website with credentialsHigh
- SEC-024Directory listing is enabledMedium
- SEC-048API documentation is publicMedium
- SEC-049Server metrics endpoint is publicMedium
- SEC-025phpinfo() page is publicHigh
- SEC-050PHP version open to the October 2026 remote code execution flawsCritical
- SEC-026Apache server-status page is publicMedium
- SEC-027Spring Boot Actuator endpoints are publicHigh
- SEC-028Runtime debug endpoints are publicMedium
- SEC-029Laravel debug tools or logs are publicHigh
- SEC-030Symfony profiler is publicHigh
- SEC-031WordPress config backup or debug log is publicHigh
- SEC-032Log files are publicly downloadableMedium
- SEC-033Cloud or registry credentials file is publicCritical
- SEC-034Docker or CI configuration is publicMedium
- SEC-035Private key file is publicCritical
- SEC-036Site backup archive is downloadableHigh
- SEC-037Subversion or Mercurial metadata is publicHigh
- SEC-038IDE project files are publicLow
- SEC-039Old TLS 1.0 or 1.1 still acceptedLow
- SEC-040Form submits to an insecure http:// addressHigh
- SEC-041Script loaded from a hijacked CDNCritical
- SEC-042Outdated jQuery with known XSS flawsMedium
- SEC-043End-of-life AngularJS 1.x in useMedium
- SEC-044Bootstrap JavaScript with known XSS flawsLow
- SEC-045Browser library with a known vulnerabilityMedium
- SEC-046Firebase Realtime Database is publicly readableCritical
- SEC-047Firebase Storage bucket can be listed by anyoneHigh
- SEC-051Software version no longer receives security fixesMedium
SEO, quality and performance
- REL-002Missing custom 404 pageMedium
- REL-003Broken internal linksMedium
- SEO-001robots.txt is missingLow
- SEO-002robots.txt blocks all search enginesHigh
- SEO-003sitemap.xml is missingLow
- SEO-004Page title is missing or a template defaultMedium
- SEO-005Meta description is missingMedium
- SEO-006Canonical URL points to another siteLow
- SEO-007No social share image (og:image)Low
- SEO-008Favicon is missingLow
- SEO-009Homepage is set to noindexHigh
- SEO-010Placeholder text left on the pageMedium
- SEO-011Email or phone number is not clickableLow
- SEO-012No analytics detectedLow
- PERF-001Slow server responseMedium
- PERF-002HTML document is very largeMedium
- PERF-003Text compression is not enabledMedium
- PERF-004Images are not compressedMedium
- PERF-005Render-blocking scripts in the headLow
- PERF-006Heavy JavaScript payloadLow
- SEO-024robots.txt blocks AI search crawlersLow
- REL-004Development build is running in productionHigh
- REL-005Long redirect chain before the page loadsLow
- REL-006robots.txt returns a server errorHigh
- REL-007Page shows an application error messageHigh
- REL-008Domain shows a parked or placeholder pageHigh
- REL-009Web server default page instead of the appHigh
- SEO-013Site is served on both www and non-wwwMedium
- SEO-014Sitemap lists pages that return errorsMedium
- SEO-015robots.txt blocks the page’s CSS or JavaScriptMedium
- SEO-016Sitemap lists URLs on another host or protocolLow
- SEO-017Structured data (JSON-LD) is not valid JSONMedium
- SEO-018Page declares more than one canonical URLMedium
- SEO-019Page has more than one <title>Low
- SEO-020hreflang links are invalidMedium
- SEO-021Page redirects with a meta refreshMedium
- SEO-022Social share image is brokenMedium
- SEO-023Canonical URL is broken or redirectsHigh
- PERF-007Versioned scripts are not cachedMedium
- PERF-008The first content image is lazy-loadedLow
- PERF-009Inline script uses document.write()Low
- PERF-010JavaScript is not minifiedMedium
- PERF-011The same script is loaded twiceLow
- PERF-012Large images embedded inside the HTMLLow
Accessibility (WCAG 2.2 AA)
- A11Y-001Page language is not declaredMedium
- A11Y-002Images are missing alt textMedium
- A11Y-003Form fields have no labelMedium
- A11Y-004Buttons or links have no accessible nameMedium
- A11Y-005Page has no main heading (h1)Low
- A11Y-006No mobile viewport, or zoom is disabledMedium
- A11Y-007No way to skip to the main contentLow
- A11Y-008Positive tabindex changes the focus orderLow
- A11Y-009Duplicate id breaks a label or descriptionMedium
- A11Y-010Embedded frames have no titleMedium
- A11Y-011Hidden content can still receive keyboard focusMedium
- A11Y-012Invalid ARIA roleMedium
- A11Y-013Media plays sound automaticallyMedium
- A11Y-014Interactive elements nested inside each otherMedium
- A11Y-015Moving text with <marquee> or <blink>Low
- A11Y-016Image alt text is a file nameMedium
- A11Y-017Image buttons have no text alternativeHigh
- A11Y-018SVG images have no accessible nameMedium
- A11Y-019Page language code is invalidMedium
- A11Y-020Focus outline removed with no replacementMedium
- A11Y-021Personal-data fields use an invalid autocomplete valueLow
- A11Y-022Label points at a field that does not existMedium
Legal, privacy and consent
- PRV-001No privacy policy linkHigh
- PRV-002No terms and conditions linkMedium
- PRV-003No cookie policy linkLow
- PRV-004Trackers load without a visible consent mechanismHigh
- PRV-005Paid product with no refund or cancellation policyMedium
- PRV-006Form collects personal data without a noticeMedium
- PRV-007Consent checkbox is pre-tickedMedium
- PRV-008No contact or business detailsMedium
- PRV-009Potential DPDP readiness gapLow
- PRV-010Unverifiable claims or reviewsLow
- PRV-011Images hotlinked from stock or image-search hostsLow
- PRV-012Privacy policy link is brokenHigh
- PRV-013Terms link is brokenMedium
- PRV-014Privacy policy does not say how long data is keptMedium
- PRV-015Privacy policy does not explain people’s rightsMedium
- PRV-016Privacy policy gives no way to contact youMedium
- PRV-017Privacy policy does not mention the trackers on the siteMedium
Source code
Defexity identifies potential risks. It does not provide legal advice or guarantee compliance.