Methodology

How the Trust Score works

TrustBadge AI scores public websites across six categories. Scores are transparent, fix-oriented, and backed by live signals whenever your site is reachable.

Privacy
Privacy policy presence and quality, tracker inventory, data minimization signals, and form privacy attributes.
Consent
Cookie / CMP detection, granular preference controls, and reject-all style consent tooling signals.
Security
TLS, HSTS, CSP, framing protections, referrer policy, security.txt, SRI, and reputation heuristics.
Accessibility
Foundational WCAG-oriented signals such as landmarks, alt text patterns, skip links, and labeling cues.
Compliance
Terms of service, AI-use disclosure, ecommerce / payment trust marks, and related readiness checks.
Trust
Brand consistency, social proof, and domain maturity signals that reduce impersonation risk.

Scoring rules

100 only if all hard checks passed
A perfect 100/100 requires every hard check to pass. Informational gaps alone do not block a perfect score, but any warning or failure keeps the score below 100 — and always surfaces concrete fixes.
Below 100 always has fixes
If the score is under 100, the report lists prioritized recommendations. There is no opaque penalty: every deduction maps to a check you can improve.
Live fetch + heuristics
When the site is reachable we fetch live headers, HTML, and DNS signals, then blend them with heuristic checks. If live fetch is unavailable, the scan falls back to simulated signals and labels that clearly.
Badge revoked below 70
Public embeddable badges are revoked when the score drops below 70 (or your configured minimum). Visitors see an unavailable state instead of a misleading trust mark.
Live signals we collect

When reachable, scans pull response headers (HSTS, CSP, framing, referrer policy), HTML cues (privacy links, CMP scripts, accessibility landmarks), and DNS email-auth records (SPF / DMARC) plus security.txt where present.

Heuristics fill gaps for brand trust, domain maturity, and reputation-style checks that cannot be proven from a single HTTP response alone.

Badge integrity

Embeds call our badge API. If the score falls below 70 (default), the badge returns HTTP 410 and embed scripts show TrustBadge unavailable instead of a stale mark.

Continuous monitoring (Pro+) rescans on a schedule so public trust marks stay aligned with the latest report.

Ready to see your score?

Run a free scan, or compare plans for badge ownership and monitoring.

Generate badgeView pricing