Site Health Suite — One Grade, Six Checks, No Faked Score

Most "website audit" tools run one check and call it a grade. This runs six — SSL, security headers, uptime, broken links, structured data, and subdomain takeover exposure — and combines them into a single letter grade that's honest about what it couldn't check.

The one design decision that matters: if a check can't run (a timeout, a blocked probe), that check contributes nothing to the score — the other checks are re-weighted to fill the gap. A site that's unreachable for SSL inspection doesn't silently get graded as if SSL were fine, and it doesn't get punished for a check that never completed either.

The six checks and their weights

Check	Weight	What it catches
Subdomain takeover	25	The one active exploitable risk in this list — weighted highest on purpose
SSL	20	Certificate validity, expiry, chain
Uptime	20	Is it actually up right now
Broken links	15	Dead internal/external links
Security headers	12	HSTS, CSP, X-Frame-Options, and the rest
Structured data	8	JSON-LD presence — an SEO signal, not a security one

A subdomain takeover risk scores worse than 100% broken links, by design — one is a live exploitable hole, the other is a maintenance issue.

Input

{ "sites": ["example.com"], "maxSubdomainsToCheck": 50 }

Sample output

{
  "site": "example.com",
  "overallScore": 95,
  "grade": "A",
  "checks": {
    "ssl": { "score": 100, "status": "valid", "expiresInDays": 74 },
    "securityHeaders": { "score": 83, "missing": ["Content-Security-Policy"] },
    "uptime": { "score": 100, "status": "up" },
    "brokenLinks": { "score": 100, "checked": 42, "broken": 0 },
    "structuredData": { "score": 0, "found": false },
    "subdomainTakeover": { "score": 100, "claimable": 0, "suspicious": 0 }
  },
  "fixList": [
    { "priority": "low", "issue": "No structured data (JSON-LD) found", "fix": "Add Organization/WebSite schema markup for richer search results." }
  ]
}

The fix list

Every run returns a priority-sorted, plain-English fix list — not a raw dump of every check's internals. A buyer wants "here's what to fix, in order," not six separate reports to reconcile themselves.

Typical uses

• Agency deliverable — one grade + a fix list is a paragraph you can put in a client report, not a data table they have to interpret.
• Pre-launch checklist — run before shipping a redesign or migration.
• Vendor/acquisition due diligence — a fast read on a site's technical hygiene.

Pricing

$5.00 / 1,000 sites checked ($0.005 per result) — priced above the single-check actors in this portfolio because a row here replaces six separate audits, not one.

⚠️ Read before you act

• Uptime and broken-link checks reflect one moment in time. Re-run periodically for a trend, not a single snapshot as a verdict.
• Subdomain takeover uses the same passive technique as the standalone Subdomain Takeover Auditor — certificate transparency + DNS-over-HTTPS + a public fingerprint database. No scanning, no login.
• A missing check (timeout, blocked probe) never fakes a score — it's excluded and the grade is renormalized over what actually ran. Check the per-check status field to see what that run actually measured.

FAQ

• Why is subdomain takeover weighted highest? It's the only check on this list that represents an active, exploitable risk right now — the others are hygiene or performance signals.
• Can I run just one check? No — this actor's value is the combined grade. For a single check, use the dedicated actor (SSL Certificate Checker, Broken Link Checker, Subdomain Takeover Auditor, etc.).

Related actors

• Subdomain Takeover Auditor — the takeover check alone, standalone.
• SSL Certificate Checker — the SSL check alone, standalone.
• Broken Link Checker — the broken-links check alone, standalone.
• HTTP Header & Security Analyzer — a deeper look at security headers alone.