Methodology
Current status: the audit suite itself (Phase 3 of this project) has not been built yet. Every site currently shows "Not yet audited" — nothing on this site is invented or estimated in the meantime. This page describes the plan so it can be checked against what actually ships.
Principles
- Passive only. We fetch pages like a browser would — the homepage and a bounded set of same-site links. No path guessing, no port scans, no form submissions, no login attempts. Security findings come only from response headers and page contents.
- Polite. At most one request per second per site, bounded page/PDF counts per audit, and a `robots.txt`-respecting, self-identifying User-Agent.
- Reproducible. Every check is a pure function of the fetched response to a pass/warn/fail/not-applicable result with evidence attached.
- Explainable. Every finding will show what it means for a citizen and how a webmaster can fix it — never a bare internal check id.
- Charitable. A site is only called "down" after two consecutive failed checks. A site unreachable only from our vantage point is "unverifiable", not "down".
Two tiers of checks
A light check (planned every 6 hours, for every site) will look at reachability, HTTP status, redirects, TLS certificate validity, response time and security headers. A deep audit (planned daily, on a rolling batch) will add accessibility, performance, content and GIGW-compliance checks, plus a screenshot.
Status definitions
| Status | Meaning |
|---|---|
| Down | Two consecutive failed light checks (DNS, connection, or HTTP status). |
| Possibly hijacked | The domain now serves a parked page, an off-site redirect, or trips a known-malware check. |
| Broken | Reachable, but blank, a default install page, "under construction", or an invalid TLS certificate that a browser would block. |
| Unverifiable | Unreachable only from our vantage point (for example, geo-blocked) — not counted as down. |
| Healthy / Needs work / Poor | A deep-audit score of 80+, 50–79, or below 50 across security, accessibility, content, GIGW compliance, performance and identity. |
| Not yet audited | No deep audit has run for this site yet. |
See docs/DESIGN.mdin the repository for the full design, including the complete check catalogue once it exists.