Kernel InitKernel Trustfree · beta · v3
Enter your domain. We look at what is public: who can send email as you, what outside code runs on your homepage and what it can see, your headers, the DNS records attackers check first, how AI assistants can read you and which lookalike domains can send email. For shops, a separate store-readiness verdict shows whether your policies, contact details and product data look like a real business. Then we tell you exactly what to change. No install, no login, nothing stored.
What we check
Everything runs from the outside, the way anyone on the internet could look. No access to your accounts, and nothing that probes private paths.
01 · Email identity · 30%
SPF followed recursively with a real DNS-lookup count, dangling includes and void lookups; DMARC policy, alignment and whether external report addresses authorized you; DKIM across common selectors and provider CNAMEs; MX provider advice, MTA-STS (policy fetched and matched to MX), TLS-RPT and BIMI.
02 · Web & headers · 20%
HTTPS and the http→https redirect, HSTS, Content-Security-Policy, framing, nosniff, Referrer-Policy, Permissions-Policy, cookie flags, mixed content and security.txt. Fixes come as snippets for your platform or host (Shopify, WordPress, Cloudflare, Vercel, Netlify, nginx and more).
03 · Third-party scripts · 20%
Scripts, iframes and pixels matched against a catalog of 233 vendor hosts with categories and a plain note on what each can see. Flags session-recording tools, public-CDN code without integrity checks, tag loaders that add more code later and Shopify's legacy ScriptTags, which stop loading on 1 March 2027.
04 · DNS & subdomains · 15%
Dangling CNAMEs and takeover candidates on 11 common subdomains (www, mail, shop, blog, app, docs, status, help, support, cdn, assets), CAA (which certificate authorities may issue for you) and DNSSEC.
05 · AI visibility & impersonation · 15%
Your robots.txt rule for 15 AI crawlers with the tradeoff of each (not scored either way), llms.txt, Organization JSON-LD and sameAs, canonical and Open Graph tags, an “if an AI assistant described your business” checklist, and 26 lookalike domains checked for a website and mail servers.
06 · Store readiness · separate verdict
A red/yellow/green self-check of what a payment processor or Merchant Center reviewer looks for first: refund, shipping, privacy and terms pages (with a thin-page check under 300 characters), a contact page with a real email, phone or address, a contact email on your own domain, legal name and address, an about page, one brand name across title, Open Graph and JSON-LD, Organization schema with contactPoint, valid sameAs, Product price, availability and GTIN, plus payment, review and badge hints and “too good to be true” signals. Homepage plus a fixed list of public paths, at most 15 requests. It doesn’t change the score, and it isn’t what any processor actually runs.
07 · Consent Proof · Phase 2
Not live. It will load your site in a real browser and record which trackers fire before anyone clicks Accept. It is not part of the score today.
Join the waitlistShare it. Every result has a link (/trust/?d=yourshop.com) with its own preview card, a downloadable PNG, Markdown and JSON exports, and a README badge at /trust/badge/yourshop.com.svg. Compare two domains side by side.
Methodology · how the score works
Each module starts at 100 and every finding costs fixed points on that module's scale. The overall score is the weighted average of the modules that ran. No hidden weights and no comparison with other businesses. Checks we couldn't run cost nothing and are listed as “not checked”.
| Module | Weight | Rules |
|---|---|---|
| Email identity | 30% | 16 |
| Web & headers | 20% | 13 |
| Third-party scripts | 20% | 5 |
| DNS & subdomains | 15% | 4 |
| AI-era visibility & impersonation | 15% | 7 |
| Store readiness | Separate R/Y/G verdict (0%) | 22 |
| Finding | Module | Severity | Points |
|---|---|---|---|
| No DMARC record | Email identity | High | −50 |
| DMARC policy is p=none (monitor only) | Email identity | High | −40 |
| SPF ends in +all (any server may send) | Email identity | High | −40 |
| No SPF record | Email identity | Medium | −18 |
| More than one SPF record (SPF fails for everyone) | Email identity | Medium | −18 |
| SPF includes a domain with no SPF record (SPF errors) | Email identity | Medium | −15 |
| SPF needs more than 10 DNS lookups (SPF errors) | Email identity | Medium | −15 |
| SPF ends in ?all or has no 'all' | Email identity | Medium | −12 |
| Subdomains exempt (sp=none) | Email identity | Medium | −8 |
| DMARC enforces on less than 100% of mail (pct) | Email identity | Low | −6 |
| Your mailbox provider isn't in your SPF record | Email identity | Low | −6 |
| DMARC sends no aggregate reports (no rua) | Email identity | Low | −5 |
| SPF has more than 2 lookups that return nothing | Email identity | Low | −5 |
| No DKIM key among the selectors we probe | Email identity | Low | −5 |
| External DMARC report address hasn't authorized your reports | Email identity | Low | −4 |
| MTA-STS announced but the policy is missing, invalid or doesn't match your MX | Email identity | Low | −3 |
| Homepage not reachable over HTTPS | Web & headers | High | −40 |
| http:// does not redirect to https:// | Web & headers | Medium | −15 |
| No HSTS header | Web & headers | Medium | −12 |
| No Content-Security-Policy | Web & headers | Medium | −12 |
| Page can be framed by any site (clickjacking) | Web & headers | Medium | −10 |
| HTTPS page references http:// scripts, styles or frames | Web & headers | Low | −6 |
| Cookies set without Secure or SameSite | Web & headers | Low | −6 |
| No X-Content-Type-Options: nosniff | Web & headers | Low | −5 |
| HSTS max-age under 6 months | Web & headers | Low | −4 |
| No /.well-known/security.txt (nowhere to report a problem) | Web & headers | Low | −3 |
| security.txt has expired or has no Expires/Contact | Web & headers | Low | −3 |
| No Referrer-Policy | Web & headers | Low | −2 |
| No Permissions-Policy | Web & headers | Low | −2 |
| Session-replay tool can record what visitors type | Third-party scripts | Medium | −15 |
| Shopify apps load via legacy ScriptTags (stop 2027-03-01) | Third-party scripts | Medium | −15 |
| More than 15 third-party hosts run code on the homepage | Third-party scripts | Low | −7 |
| Public-CDN library loaded without SRI | Third-party scripts | Low | −6 |
| Script hosts not in our catalog | Third-party scripts | Low | −4 |
| Subdomain points at an unclaimed third-party service (takeover candidate) | DNS & subdomains | High | −45 |
| Subdomain CNAME points at a name that doesn't exist | DNS & subdomains | Medium | −15 |
| No CAA record (any certificate authority may issue for you) | DNS & subdomains | Low | −5 |
| DNSSEC not enabled | DNS & subdomains | Low | −5 |
| Lookalike domains registered with mail servers (email-capable) | AI-era visibility & impersonation | Medium | −15 |
| robots.txt blocks all crawlers from the whole site | AI-era visibility & impersonation | Medium | −10 |
| Lookalike domains registered and resolving (not proof of intent) | AI-era visibility & impersonation | Low | −7 |
| No Organization / brand structured data (JSON-LD) | AI-era visibility & impersonation | Low | −6 |
| Canonical or og:url points to a different site | AI-era visibility & impersonation | Low | −5 |
| No Open Graph title/image (bad link previews) | AI-era visibility & impersonation | Low | −4 |
| Structured data doesn't link your official profiles (sameAs) | AI-era visibility & impersonation | Low | −3 |
| Storefront homepage not served over HTTPS | Store readiness | High | −40 |
| No refund / return policy found | Store readiness | High | −30 |
| No contact page or contact details | Store readiness | High | −30 |
| Only free-mail contact address (Gmail, Hotmail, …) | Store readiness | High | −25 |
| No shipping policy found | Store readiness | High | −20 |
| No privacy policy found | Store readiness | High | −20 |
| No legal business name or address on the site | Store readiness | Medium | −15 |
| Policy still contains template placeholder text | Store readiness | Medium | −15 |
| Contact details thin (fewer than two of email, phone, address) | Store readiness | Medium | −10 |
| Policy page under 300 characters of text | Store readiness | Medium | −10 |
| Social links point at the theme or platform's own profiles | Store readiness | Medium | −10 |
| No terms of service found | Store readiness | Medium | −8 |
| No about page | Store readiness | Medium | −8 |
| "Too good to be true" claims (70%+ off, miracle/guaranteed results) | Store readiness | Medium | −8 |
| No Organization JSON-LD on the homepage | Store readiness | Low | −6 |
| Product JSON-LD missing price, availability, GTIN/MPN, brand or image | Store readiness | Low | −6 |
| Legal name or business address missing (one of the two) | Store readiness | Low | −5 |
| Contact email not on the shop's own domain | Store readiness | Low | −5 |
| Brand name differs across title, og:site_name and JSON-LD | Store readiness | Low | −5 |
| Organization JSON-LD without contactPoint | Store readiness | Low | −4 |
| sameAs profile URLs invalid or placeholders | Store readiness | Low | −4 |
| Generic "guaranteed safe checkout" style badge text | Store readiness | Low | −3 |
Bands: Strong 85+ · Fair 65+ · Weak 40+ · Exposed below 40. Rubric version 3.0.0 (2026-11-02); the scanner and this page read the same file (src/worker/rubric.json), so the table can’t drift from the code.
v3.0.0 · 2026-11-02
v2.0.0 · 2026-11-02
v2026-11-02 · 2026-11-02
FAQ
No. It is a passive, external check of public DNS records and your public homepage at one moment. It is not a penetration test, an audit or a compliance certificate, and a good score doesn't mean a site can't be attacked.
One homepage request over HTTPS (plus redirects), one plain-http request to see whether it redirects, and three small public files: /robots.txt, /llms.txt and /.well-known/security.txt. If you publish MTA-STS we fetch that policy file, and we load the front page of a few common subdomains whose CNAME points at a hosting provider. Everything else is public DNS over HTTPS. The store-readiness check also opens up to 15 fixed public paths (policy, contact, about and terms pages). We never try private paths such as /.git or /.env, and we never log in.
No. Results are kept in memory for up to 10 minutes so a shared link or badge loads quickly, then they are gone. There is no database, no list of recent scans, no cookies and no analytics scripts. To rate-limit scans, your network's IP address is kept in memory for up to an hour, never written to storage by us. Cloudflare, which hosts the site, may show us aggregate request counts in its own dashboard.
Every scanner weighs things differently. Ours is the weighted average of five module scores, using the public rubric on this page. Each finding shows what we saw and the rule it matched, so you can check our reasoning.
Not necessarily. A registered lookalike with mail servers can send and receive email, which is why we show it, but you, a reseller or a domain parker may own it. Check who owns it before acting.
It's a tradeoff, and we don't score it. Blocking a training crawler keeps future crawls out of that company's training data; blocking an assistant or search crawler can also keep you out of its answers. The result lists each crawler, what your robots.txt says and what changing it would do.
No. It is our own self-check heuristic built from public pages: your policies, contact details, business identity and product data, read the way a reviewer might read them. Payment processors and Google Merchant Center use their own private signals, your account details and documents, and transaction history, none of which we can see. A Green verdict doesn't guarantee approval and a Red one doesn't mean you'll be suspended. Domain age isn't checked.
The homepage you already gave us, then a fixed list of public paths on the same site: policy pages such as /policies/refund-policy or /refund-policy, contact, about and terms pages, at most 15 requests in parallel. No crawling, no product pages, no checkout, no forms, and nothing behind a login.
Yes. Everything we read is public, and the compare page shows two domains side by side. Please be fair with the result: a score says which public setup has fewer of the issues we check, not which business is safer.
What we don't do
Results live in memory for up to 10 minutes so a shared link or badge loads fast, then they are gone. No database, no recent-scans list, no cookies, no analytics scripts. Our host, Cloudflare, may show us aggregate request counts.
A handful of public web requests (up to 15 more for the store check), identified as KernelTrust/2.0; everything else is public DNS. We never request private paths. Scans are rate limited per network.
We read the homepage HTML without running it, so scripts added later by other scripts may be missing. DKIM is a probe, not proof. It can't tell whether anything was ever breached, and it doesn't measure any law or standard. Each result ends with the full list of what we don't check yet.
Status: beta. A scan runs as five parallel parts (email, DNS, web, lookalikes, store readiness); if one part times out, the others still score and the result says which part didn't finish. Automated external checks, not legal or security advice. A result reflects public DNS and your homepage at the moment of the scan.
Deep audit · Posture
Kernel Trust is the free first look. Posture is the deep-audit module: every page type, TLS and DNS in depth, benchmarks against similar stores and fixes in priority order.