Every rule we grade by. Published so you can check us
The same engine as our free site check, run on the 100 most-visited US websites on October 25, 2026.
Which sites
The 100 most-visited US sites in September 2026, per Semrush and Similarweb, minus adult sites, redirects and ad domains. No site can pay to be listed or to change its grade.
How we measure
- A real US browser loads the homepage at least twice and makes no choice on any banner. A tracker that fired on any visit counts.
- ComplyMoBot, which follows robots.txt, reads the homepage and up to 4 linked pages for accessibility and policy links.
- We read headers, the https redirect, security.txt, the site's own scripts, and its linked terms and privacy policy. We never test logins or probe for holes.
What counts as a tracker
A known third-party tracker that sends data or sets a cookie before any choice. A tag that only loads, or a Consent Mode ping with storage denied, doesn't count.
What costs points
Each pillar starts at 100 and loses these points once per kind of finding. The grade is the weighted average.
Consent and tracking
- Ad trackers before a choice−45
- Analytics before a choice−20
- Session recording−15
- Trackers with no banner−10
- Ad trackers with no opt-out link−10
Security
- Possible secret key in public code−70
- No HTTPS−60
- No HSTS header−15
- No Content-Security-Policy−15
- Mixed content−12
- No https redirect−10
- No framing protection−8
- No X-Content-Type-Options−5
- No Referrer-Policy−4
Accessibility
- Images with no alt text−15
- Unlabeled form fields−15
- Pinch zoom blocked−15
- Unnamed buttons−12
- Empty links−10
- No page language−10
- Video without captions−10
- No accessibility statement−6
- Skip link, title, heading or tabindex gaps−5
- No autocomplete, or "click here" links−4
Transparency
- No privacy policy link−40
- No terms link−10
- No security.txt−5
Grades and caps
A+ is 97 and up, A 90, B 80, C 70, D 60, F below. Ad trackers before a choice cap a site at C. A possible secret key or no HTTPS caps it at D.
Shown, never scored
Domain age, policy length, arbitration, class-action waivers and AI mentions. Reading times use 238 words a minute, from Brysbaert 2019 (opens in a new tab).
Not graded
Sites that refused or rate-limited us, never finished loading, or served a stripped page with no privacy or terms link. We list them with the reason instead of guessing.
What this can't see
Anything behind a login or in an app, first-party tracking, how data is stored or sold, and past breaches. Automated accessibility checks catch only part of what people hit, so a clean score is a floor. A dated snapshot, not an audit or legal advice.
Corrections
Run one of these sites? Tell us what changed and we'll recheck it. Our own site goes through the same check, and you can run it on yours.
Get your own site to an A
14-day free trial · card needed to start, cancel before day 14 and you pay nothing