Check how well any website is actually secured. Traffic Lens runs five independent checks against the live domain and combines them into a single 0-100 score with an A-F grade. It is free, needs no signup, and works on any domain.
The score is a weighted average of five pillars. Each is checked in real time — nothing is estimated, cached from a third-party rating, or modelled.
Reads the live TLS certificate: issuer, issue and expiry dates, the hostnames it covers, and whether HTTPS actually serves on port 443. A certificate that exists but does not serve is treated as a partial failure, because a visitor cannot benefit from protection the server never presents. Certificates close to expiry lose points before they lapse, since a lapsed certificate produces a browser warning that stops most visitors dead.
Inspects the HTTP response headers that browsers act on: HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. These are the difference between a site that merely uses HTTPS and one that instructs the browser to refuse downgrades, block framing, and stop guessing content types. They cost nothing to add and are absent on the majority of sites.
Reads the registration date over RDAP, the modern replacement for WHOIS. Age is one of the very few trust signals that is genuinely expensive to fake: a ten-year-old domain cannot be manufactured on demand, which is why fraudulent sites are so often only days or weeks old. The score saturates at ten years, so a fifteen-year-old domain and a ten-year-old one are treated alike.
Checks SPF, DKIM and DMARC records. These decide whether someone else can send mail that appears to come from the domain. A domain with no DMARC policy can be spoofed in phishing campaigns aimed at its own customers, which makes this a trust signal about how the organisation treats the people who deal with it, not only about the website.
Looks for CAA records, which restrict which certificate authorities may issue for the domain, and DNSSEC, which cryptographically signs DNS answers so they cannot be quietly altered in transit. Both are optional, both are uncommon, and both indicate an operator paying attention.
Scores of 80 and above indicate a site with the security basics in place. The 55 to 79 band is the broad middle where most legitimate sites sit, usually because they have skipped security headers or email authentication. Below 55 means several fundamentals are missing.
Read the number as one signal, not a verdict. A low score means a site has fewer safeguards than well-run sites tend to have; it is not evidence of bad intent. New businesses and small sites routinely score poorly simply because they run on default hosting configuration and have never been tuned. Equally, a high score is not proof of honesty — it means the technical basics are handled, and a competent scammer can handle those too.
Wikipedia is the clearest illustration. It is among the most trustworthy sites on the internet and scores in the sixties here, because it deliberately runs a minimal header and email-authentication setup. The score is measuring configuration, and configuration is not the same thing as trustworthiness.
If one of the five checks fails — an RDAP timeout, an unreachable host — that pillar is dropped from the calculation rather than counted as zero, and the page tells you the score came from four of five checks. Counting a failed lookup as a failing grade would make the number actively misleading, because a WHOIS server being slow says nothing whatever about the site being examined.
No. It means fewer technical safeguards are present. Plenty of legitimate sites score poorly, particularly new ones. Use the score alongside your own judgement, not instead of it.
Broadly yes, because the weights are fixed. But a domain scored on five checks and one scored on three are not strictly comparable, which is why the completed-check count is always shown alongside the score.
Results are cached for thirty minutes. Certificate renewals, new security headers, and DNS changes all move the score once the cache expires.
See all free domain tools