Skip to main content
Scorecard + remediation agent

Know what to fix first,
within the effort you have.

Fulcrum grades a site’s security posture from A to F and returns a remediation plan sized to a fix-effort budget you set — with the reasoning shown, not just a number. Check any site’s headers in a second; prove you control a domain to run the full scan, including TLS.

Get startedSign in

2FA required on every account · TLS scanning restricted to verified domains

D

example.com

Score 50/100 · 10 findings

  1. No clickjacking protection1pt → −11
  2. Certificate near expiry2pt → −14
  3. MIME sniffing not disabled1pt → −4
  4. Obsolete cipher suites2pt → −4

budget 15 · 14 used · 3 deferred

Example output. Not a real site’s result.

Try it on any site

Type a hostname. Fulcrum makes one ordinary HTTPS request to it, the same as a browser opening the page, reads the security headers in the response, and grades them. Nothing is stored and no account is needed.

What the agent does

Header & transport posture

Eight header checks — HSTS, CSP, frame options, MIME sniffing, referrer policy, permissions policy, version disclosure and cookie flags. TLS, including protocols, ciphers and the certificate chain, is examined by testssl.sh 3.2.4, pinned and run locally.

Version-aware CVE context

Where a server advertises its version, that version is matched against a curated set of 16 CVEs covering common web server software, carrying EPSS exploitation likelihood rather than CVSS alone. It is a snapshot, not a vulnerability database, and every result says so.

Budget-aware remediation

Set a fix-effort budget. The agent ranks remediations by risk reduced per unit of effort and shows the reasoning behind the order it chose — including when it defers the worst finding because three cheaper ones remove more risk.

Probing requires proof of ownership

A headers check is one request, so it runs against any public site. The TLS scan opens hundreds of connections, so it runs only against a domain you have verified by DNS or a well-known file. Refusals are logged.

Questions

Is it safe to check a site I do not own?
A headers check sends one ordinary HTTPS request, the same as a browser opening the page, and reads the response. It does not probe further, and it is rate-limited per person and per target. Anything heavier — the TLS scan, which opens hundreds of connections — only runs against a domain you have proved you control.
What does the grade actually mean?
It summarises only the checks Fulcrum runs: eight security-header checks, TLS configuration on full scans, and matches against a small curated set of known vulnerabilities for any software versions a server discloses. A serious finding cannot be averaged away by passing everything else. It is not a statement that a site is or is not secure.
How do I prove I own a domain?
Publish a TXT record Fulcrum gives you, or serve a small file at a fixed path on the site. Either needs control of the domain, and the DNS method is the stronger of the two. The proof expires after a set period — 90 days by default — and you renew it by running the same check again, because who owns a domain can change.
Why do I need an authenticator app?
Every account uses a 6-digit code from an authenticator app as well as a password, including when you reset a password. An account on a security tool is worth attacking, and a code that changes every 30 seconds is what makes a stolen password not enough. Keep the backup codes you are shown: they are the way back in if you lose your phone.
What happens to my data?
Your email address, a hash of your password, the domains you register and your scan results are stored so the service works. You can download everything or delete your account from the account page. Security audit records that name you are kept for a limited time and then destroyed. The privacy policy lists every field.
Does it cost anything?
No. Fulcrum is free to use.

What this is not

  • A passing grade means the checks Fulcrum runs did not find a problem. It is not a guarantee that a site is secure, and no tool — this one included — can offer that.
  • Fulcrum inspects what is reachable from the outside: headers, TLS configuration, and version fingerprints.
  • It does not review your application logic, your dependencies, your infrastructure, or your people. Treat the scorecard as one input among several.