Is your site solid?

How it combines: Each layer is the median of the scores from the organisations that measure it; in layers measured by two organisations, no single organisation can decide the result on its own. Measurements from the same organisation count as one vote. If a measurement can't be taken at the time, the layer is calculated from the rest; the weight of a layer that couldn't be measured at all is spread over the others. Labels: 90 and above Solid · 70–89 Good · 50–69 Needs work · below 50 Weak.

Thresholds: Measurements are turned into points on a straight line: 100 up to the good threshold, from 100 down to 50 between the good and poor thresholds, and 0 at twice the poor threshold. The speed thresholds are the published Core Web Vitals values: LCP 2.5 and 4 s, INP 200 and 500 ms, CLS 0.1 and 0.25, FCP 1.8 and 3 s, server response 0.8 and 1.8 s. Weights for real-user data: LCP 30%, INP 30%, CLS 20%, FCP 10%, server response 10%. The page weight (2.6 and 3.9 MB) and HTML size (100 and 500 KB) thresholds are our own, chosen from how much real pages weigh.

Critical findings: Some gaps destroy trust on their own. While threat-list checking is on, a site that looks suspicious on malware or phishing lists gets at most 20 and carries the "Suspicious" label. A site that doesn't offer a valid HTTPS connection gets at most 49.

Measurement confidence: Every report says High, Medium or Low. High has three conditions: at least 95% of the score must be measured, at least half of it must be measured by two separate organisations, and the average difference between organisations must not be more than 20 points. Medium if at least 80% is measured, Low if less.

The What to do list: We work out how much each gap takes off the total score today: layer weight × the gap's share of the layer × the shortfall. The list is sorted by this share; the figure next to each step is roughly what fixing it adds to the total score. Critical findings are always at the top; while there is a critical finding, the other steps' contributions show once it has been fixed.

Record and history: When the check finishes, the result is stored with a record number, and anyone can verify it at traverta.dev/en/record/… The score on the record is written by our server, not by the browser: every measurement response is signed on the server, the signatures are verified when the check ends and the score is calculated again, so the record can't be changed afterwards. When the same address is checked again, a comparison with the previous measurement appears. If the score is the same, it says "No change"; differences of up to 2 points are shown in grey as "normal variation" and don't count as a change, because scores are rounded to whole numbers and the same site can move this much when measured twice in a row. A record's page shows every measurement of that address with its date and time on a timeline (score history); the PDF includes only the measurements made up to that record, so the record doesn't change afterwards. A record is a measurement record; it is not a certificate, a security guarantee or an accreditation. We keep records for two years and delete them at the site owner's request.

The pages your visitors see (optional): When the check finishes, the site owner can choose the Pages and screens report from Analytics as a CSV file; the file is read only in the browser and isn't sent to us. Pages are grouped into types by the first part of their address (a language prefix is skipped). From the most visited types, we choose enough to cover at least 80% of visits, and at most four types; a type with less than 2% of visits isn't chosen. The most visited page of each type is measured with the independent speed measurement, the scores are weighted by the number of visits, and the type that would gain the most (the largest share of visits × missing points) is named separately. The result doesn't count toward the main score or the measurement record.

Measurement sources: Independent outside measurements come from the public measurement services of organisations independent of TRAVERTA, and they appear as "Cross-Check" in the result. We publish the method but not the names of the service providers. Data whose licence asks for credit is listed on the Licences and credits page. We don't measure page-load timings (such as LCP and CLS) on our own server, because browser timings aren't reliable in a serverless environment. The only time we measure ourselves is the server's first response time (from Frankfurt). Our own browser only measures things that come out the same every time: bytes, cookies, headers and accessibility rules.

Validation: We test every new measurement against examples whose results we know. A test page that sets a known tracking cookie was caught correctly; on a news site known to set tracking cookies without consent, the privacy score from our browser measurement came out as 0. When we measured two large sites twice each, a minute apart, the largest difference in our browser measurement was 0.03 points and the difference in page weight was under 0.1% (9 November 2026).