Security audit findings — live from the corpus
The 50 lowest-scoring domains in the CheckFast corpus — ranked by aggregate health score across SSL, DNS, email authentication, SEO, redirects and Open Graph. These sites have the most room for improvement.
A low aggregate score is almost always the result of a handful of compounding failures rather than one catastrophic misconfiguration. The most common pattern across low-scoring domains: no DMARC record (or DMARC at p=none, which offers no protection against spoofing), an outdated TLS configuration with deprecated cipher suites, missing security headers, and an SEO configuration with broken canonical tags or missing structured data. Each issue alone might score an amber warning; together they compound to a red band.
Email authentication is the single biggest differentiator between high-scoring and low-scoring domains. A domain without SPF, DKIM and DMARC at enforcement is trivially spoofable — anyone can send mail that appears to come from that domain. This is not an esoteric attack vector; it is the primary mechanism behind most phishing campaigns that exploit brand trust. CheckFast's email checker scores this hard because the fix (publishing three DNS records) takes under 30 minutes.
SSL issues on this list range from expired certificates (the most embarrassing failure mode — it interrupts all HTTPS traffic) to untrusted intermediate chains and misconfigured HSTS headers. Many low-scoring domains have valid leaf certificates but fail on chain completeness or on the presence of deprecated TLS 1.0/1.1 support.
This leaderboard is published not as a hall of shame but as a calibration tool. If your domain appears here, run a live check to see the specific findings — each result includes remediation guidance. Most issues surfaced by CheckFast can be resolved in under an hour without any code changes: it is almost always a DNS record, an HTTP header, or a sitemap configuration.