Terms of use

These terms cover this site, the scanner at /api/scan and the badge endpoints. They are short because the product is narrow: a measurement from one vantage point, published with its evidence.

What this service does

It scans public websites from Cloudflare's network and publishes what it observed: a score, a grade, a level and the evidence behind each check. The rubric is public at /methodology.

A measurement is an observation at a time. It is not a statement of fact about a site, its owners or its future.

The measurement is offered as is

• One vantage point. A CDN node, a geo rule, a rate limit or a bad minute can change what the scanner sees.
• The scanner refuses to score what it cannot read. A site that blocks an automated client gets score: null and a reason, not a low number.
• Every check carries the evidence behind it, so a disagreement can be checked against the request that produced it.
• A score is not a certification and not a security assessment. It describes the machine-facing surface, measured.

The score is reproducible; the rubric changes

The fingerprint is a SHA-256 digest. It binds the host, the rubric version, and each check's id, status, rounded points, and counted flag.

For a record measured under the current rubric, /verify recomputes the score, grade, and level from those, and reports a mismatch as tamper evidence. The score, grade, and level follow from them under the site profile and commercial signal the record names.

What is not bound: the detail and evidence text, the out-of-scope or not-measured label, the site profile, and the commercial signal. An edit is caught only when it disagrees with the bound check outcomes.

Apart from the clock, the same host, responses, rubric version, and site profile produce the same digest. The site can stay the same while the digest moves, for 3 reasons:

• security-txt and status-page read the clock. Their outcome can change with the date alone.
• A response slower than 12 s is recorded as not measured. The same bytes served slowly can move the score and the fingerprint.
• A scan still running after 60 s stops, and it is reported as not measured.

The rubric changes. It is v0.7 today, with 61 checks across 5 dimensions. The version is printed beside every score and included in the fingerprint.

A record measured under an older rubric does not reproduce the current one, so the record keeps the version it was measured under. Two scores are comparable only when their versions match, and the directory reports the versions it holds.

A site can be measured without asking

The scanner reads public paths. It does not log in, sends no credential, and does not execute script.

It requests a fixed probe list, plus a capped number of URLs on the same origin that the site's own documents name. What the scanner requests lists each source and its cap, up to 136 URLs in all.

A measurement is not a listing. Nothing appears in the verified section of /directory until the owner claims the host with POST /api/badge/claim and publishes the returned token on the host itself. A measured exemplar is our measurement and not their claim: it is labelled as one, it carries its fingerprint, and it is withdrawn on request.

A report page carries noindex, and its 5 files carry the same instruction in an X-Robots-Tag header. A scan of your site is not a page this service asks a search engine to rank.

If you own a measured site and want the record gone or the scans stopped, abuse and removal is the page for it.

Acceptable use of the endpoints

GET /api/scan?target=<host> and POST /api/scan with {"target": "<host>"} measure a public host. No credential is required, and none is issued.

A stored record younger than 6 hours is returned instead of a new scan, unless the request sets fresh=1. A request that declares a site profile reuses only a record measured under that same declared profile. A request that declares none reuses only a record whose profile was detected.

• Public hostnames only. An IP address is refused, whether it is public or not. So is a port Cloudflare does not proxy, and /bot lists the ports. A name that resolves to a loopback, private, link-local, or metadata address is refused when the scanner checks it. Cloudflare resolves the name again when it connects. /bot says what that leaves open.
• The guard is on by default. Only an operator flag, ALLOW_PRIVATE_TARGETS=1, turns it off, and it exists for local self-auditing. /api/health reports ssrf-guard-disabled whenever it is off.
• At most 10 scans per client per minute, and 3 scans running at once. Over either ceiling the API answers 429 with a Retry-After header.
• At most 10 badge claims and 10 verifications per client per minute. Verification is also limited to 3 per token every 10 minutes, whoever asks.
• At most 30 health checks per client per minute at /api/health.
• Do not present a stored score as an independently produced measurement, and do not re-publish one without its fingerprint.
• Do not point the scanner at a third party through a redirect. Every hop is resolved again, and a private address is refused.

POST /api/badge/claim returns a token and a snippet. POST /api/badge/verify lists the host only when it finds that exact token on the host. The token must be the content of the agenticwebscore-verify meta tag, in the head of /, /agenticwebscore, or /verify.

The badge is a licence to display the image

The badge at /badge/<host>.svg is served by this service. You may display the image as it is served, on the site it names.

The licence ends when verification does. A listing is published only while it was confirmed within the last 30 days.

When a listing lapses, the badge still shows the stored score and says it is not listed in the directory. A host with no stored record shows the neutral badge.

Nothing re-verifies a listing on its own. Keep the meta tag in the head of your homepage, and have POST /api/badge/verify find it at least every 30 days. The listing stands while you do both. Remove the tag and the claim ends.

Do not redraw the badge or serve a stored copy from your own host. A badge that outlives its verification is a claim nobody can check.

No warranty

The site, the measurements and the API are provided as is, without warranty of any kind. No uptime and no particular result are promised.

A check can be wrong. A proxy, a firewall, a redirect or a temporary error can make the scanner record something a visitor does not see. The evidence line is what it observed.

Limitation of liability

This service is not liable for indirect or consequential loss arising from the site, a score, a grade, a badge, or the API. That limit applies to the extent the law allows.

A score is 1 input. Do not make a purchase, a contract, or a security decision on it alone.

Changes to these terms

These terms describe the build that publishes rubric v0.7, updated 2026-10-12. A changed term is published here, with the rubric version it belongs to.

Contact

Corrections, licensing questions, and removal requests go to hello@agenticwebscore.com. Abuse and removal covers the scanner specifically.