331 services carry this tag in their source record. Tags come from the provider, not from us — a tag is a claim about what the service does, not proof that it does it well.
Paid redirect-chain security audit — full chain traversal (max 10 hops), open-redirect detection (//, @, javascript:), cross-domain count, https-only check, meta-refresh detection, redirect-security_score A-F grade via x...
Paid PWA Web App Manifest audit via x402
Paid HTTP/3 + Alt-Svc endpoint-discovery audit — parses RFC 7838 Alt-Svc header for h3/h3-29 protocol advertisement, captures port + host + max-age + persistent flag, reports advertised_h3, advertised_h3_port, advertised...
Paid Wayback Machine CDX-API archive availability audit — snapshot_count, first_snapshot, last_snapshot, age_at_first_snapshot_days, age_at_last_snapshot_days, years_active, snapshots_per_year, is_archived, is_recently_a...
Paid URL safety audit (sandbox-friendly) — 12-signal heuristic preflight for AI agents deciding whether to render/embed a URL: scheme allowlist (http = medium risk, mailto/file/javascript/data = high), Suspicious-TLD cat...
Paid deep TLS handshake probe — TLS version (1.0/1.1/1.2/1.3) + cipher suite classification (aead-strong/strong-fs/weak/legacy-fs) + ALPN negotiation (h2/http1.1) + Alt-Svc h3 HTTP/3 endpoint discovery + key_exchange gro...
Paid cache-freshness strategy audit — probes HTML page + /favicon.ico + /robots.txt + /sitemap.xml + first stylesheet URL + first script URL; for each captures Cache-Control directives + ETag + Last-Modified + Age + Vary...
Paid CORS policy audit — baseline GET captures all Access-Control-* response headers (ACAO/ACAC/ACAM/ACEH/ACMA/ACRPN/ACEP/ACEN), dangerous-combo detection (ACAO=* + ACAC=true, ACAO='null', attacker-origin echo), prefligh...
Paid form security + accessibility audit — per-form action analysis (empty/#/javascript:/data:/mixed-content http-on-https), method (GET with passwords = credential-in-URL), enctype (text/plain CRLF injection), target=_b...
Paid HTTP-method policy + dangerous-method exposure audit — OPTIONS Allow/DAV/ACAO/ACAM + TRACE echo-back + CONNECT + PUT/DELETE/PATCH write exposure + 4 method-override header sniffing (X-HTTP-Method-Override/X-Method-O...
Paid security.txt RFC 9116 deep audit — path discovery tries /.well-known/security.txt then /security.txt, parses all fields with line-continuation support, strict Contact format validation (mailto: + https://), strict E...
Paid deep HTTP redirect chain analyzer — per-hop latency_ms + headers (server/content-type/cache-control/x-cache/cf-ray/cf-ipcountry/vary/set-cookie count/hsts) + status sub-type classification (301/302/303/307/308) + cr...
Paid Open Graph + Twitter Card spec validator — required OG detection (og:title/type/image/url), recommended (description/site_name/locale/image:width/image:height/image:alt), og:type enum validation (website/article/boo...
Paid security exposure-surface audit — HSTS preload-list membership via hstspreload.org API + HSTS header detection, RFC 9116 security.txt presence+format-validity (Contact/Expires/Canonical/Preferred-Languages), 18-path...
Paid exhaustive meta-tag coverage audit — title + meta_description + meta_robots + meta_keywords + meta_author + meta_generator + meta_theme_color + meta_viewport + 17 OG fields (og:title/description/image/url/type/site_...
Paid page weight audit — HTML+CSS+JS+image+font byte breakdown (compressed + uncompressed) + per-category bytes + third-party resource ratio + render-blocking resource count + HTTP/2/3 ALPN detection + transfer-vs-uncomp...
Paid mobile/responsive viewport meta audit — viewport tag (width=device-width,user-scalable), apple-mobile-web-app-capable, theme-color, format-detection, apple-touch-icon + manifest.json detection, touch-icon coverage,...
Paid HTTP cache-control audit — probes favicon/robots/sitemap headers (Cache-Control+max-age+s-maxage+immutable+stale-while-revalidate / ETag / Last-Modified / Vary / Surrogate-Control / CDN-specific) returns cache_valid...
Paid affiliate-program presence detection — 17-path landing-page probe with content signals + 16-network fingerprint (ShareASale/CJ/Impact/PartnerStack/Awin/Rakuten/ClickBank/Refersion/FirstPromoter/Tolt/LemonSqueezy/Gum...
Paid domain contactability audit — email/phone/physical-address/contact-page/social-profile/live-chat/contact-form detection with contactability_score 0-100 A-F grade via x402
Paid E-E-A-T signal audit (Experience/Expertise/Authoritativeness/Trust) — JSON-LD Organization/Person/author markup + byline + author bio links + about/contact/team/editorial/corrections/funding pages + social profile v...
Paid canonical URL consensus audit — link rel=canonical + HTTP redirect final + og:url + twitter:url + JSON-LD url/@id/mainEntityOfPage + hreflang x-default compared, consensus URL + agreement_count + canonical_health_sc...
Paid page render-mode + hydration-profile detector — Next/Nuxt/Remix/Astro/SvelteKit/React/Vue/Angular framework hints + body word count + hidden DOM % + noscript fallback + window.* hydration data keys + verdict string...
Paid content-freshness detector (publish/modified dates from meta/JSON-LD/HTTP headers/time elements, age in days, A-F grade) via x402