Multi-Source Website Health Scanner: One URL, a Real Graded Audit
TechDoctor is a live website health scanner that answers a simple question with real data: how healthy and secure is this site? Send it a URL and it runs a multi-source audit in parallel — grading security headers (CSP, HSTS, cookie flags, CORS), inspecting TLS and certificate configuration, checking page quality, and testing accessibility. Each module returns a letter grade and a score backed by concrete findings, not a vague thumbs-up. In the verified live run against stripe.com, the header module graded the site A+ (score 100, 8 of 10 checks passed with the 2 failures named) and the TLS module graded the endpoint A+ (score 100) — real graded output, not a stub. What sets it apart is its honesty under partial failure: when the page-quality source was unavailable and the accessibility source needed a paid API that is off by default to keep scans free, TechDoctor reported those modules as 'unavailable' and 'needs_config' rather than inventing numbers. The service runs as a systemd process on the VPS and is reachable over the public Cloudflare route.
Key Metrics
Audit coverage
Before
Separate tools for headers, TLS, page quality, and accessibility
After
One scan covering all four dimensions, each independently graded, from a single /api/scan call
Verified grading
Before
N/A
After
stripe.com graded A+ on security headers (score 100, 8/10 checks) and A+ on TLS (score 100) — real graded output
Partial-failure honesty
Before
Scanners that substitute filler scores for checks they can't run
After
Unmeasurable sources report 'unavailable' / 'needs_config' — no fabricated grades
Cost model
Before
Paid scans or all sources billed by default
After
Core scan free and open; paid-API sources kept off by default so the free scan still returns real grades
Watch the Walkthrough
The Challenge
A website owner who wants to know 'is my site secure and healthy?' faces a scattered landscape of single-purpose tools: one site for security headers, another for a TLS grade, a third for accessibility, a fourth for performance. Each returns its own format, its own scale, and its own gaps — and stitching them into a single answer is manual work. Worse, many scanners paper over the checks they cannot run: rather than admit a module is unavailable, they return a filler score that looks real but means nothing. For anyone making a decision based on the report — a developer hardening a launch, an agency auditing a client — a fake 'B' is worse than an honest 'not measured'. The need is a single scan that aggregates the important health dimensions, grades each with real findings, and is transparent about what it could and could not measure.
Why This Approach?
Scan architecture
Multi-source aggregation — independent graded modules behind one /api/scan call
Header security, TLS, page quality, and accessibility are genuinely different measurements with different failure modes. Running them as independent modules that each return their own grade — then aggregating — means one module going down never invalidates the whole report, and each dimension keeps its own honest verdict.
Alternatives considered: Single monolithic check, one third-party scanning SaaS, separate tools per dimension
Partial-failure handling
Per-source status reporting ('unavailable', 'needs_config') instead of filler scores
A scanner's entire value is trust in its numbers. Returning status 'unavailable' for a source that could not run — and 'needs_config' for one gated behind a paid API kept off by default to keep scans free — is honest partial data. A fabricated score would be worse than no score, because a user would act on it.
Alternatives considered: Fail the whole scan, silently drop failed modules, substitute a default score
Access model
Public scan API, no auth, free by default
Keeping the core scan open and free maximizes utility for the common case (checking a site's headers and TLS). Paid-API-backed sources like the accessibility module stay off by default rather than silently billing or blocking — the free scan still returns real, useful grades.
Alternatives considered: Auth-gated scans, paid-per-scan, enable all paid sources by default
Build Process
Security header grading
The TechDoctor Header Review module inspects a site's security headers — CSP, HSTS, cookie flags, CORS — and returns a letter grade with concrete pass/fail findings. Verified live: stripe.com graded A+ (score 100) with 8 checks passed and the 2 failures explicitly named, so the report shows exactly what was checked and what fell short.
TLS and certificate audit
The TechDoctor TLS Review module grades the endpoint's TLS and certificate configuration. Verified live: stripe.com's endpoint graded A+ (score 100) across its checks — a real graded verdict on transport security, not a boolean 'has HTTPS'.
Page quality and accessibility modules
Additional modules cover page quality and accessibility. These demonstrate the scanner's honest degradation: in the verified run, page quality returned status 'unavailable' and accessibility returned 'needs_config' (its paid API kept off by default to keep scans free) — reported transparently rather than filled with fake data.
Aggregation and live delivery
All module results aggregate into a single scan response with per-source grades, scores, and findings, served over the public Cloudflare route from a systemd service on the VPS. The scan is resilient to transient Cloudflare edge errors — the core job succeeded on retry per the no-arbitrary-timeout recovery doctrine.
Challenges & Solutions
Impact
Owners run one tool for headers, another for TLS, another for accessibility — each with a different format and scale — then stitch the answer together by hand.
Solution
A single /api/scan call that runs security-header, TLS, page-quality, and accessibility modules in parallel and aggregates them into one graded report.
Result
One URL in, a multi-dimension graded audit out — verified live against stripe.com with A+ header and A+ TLS grades from a single request.
How AI Powers This
AI Capability
Multi-Source Health Aggregation
Get one graded report covering security headers, TLS, page quality, and accessibility from a single URL — no stitching together four separate tools
Business outcome
A single request produced A+ header and A+ TLS grades for stripe.com with named passing and failing checks
Under the hood
POST /api/scan {url} -> parallel module execution (header review, TLS review, page quality, accessibility) -> aggregate response with per-source grade, score, and findings
How success is measured: Grade accuracy vs known-good sites, coverage across dimensions, findings specificity
AI Capability
Honest Partial Degradation
When a check can't run, the report tells you so — you never act on a fabricated grade
Business outcome
Verified: page-quality 'unavailable' and accessibility 'needs_config' reported transparently while working modules still graded the site
Under the hood
each module reports its own status; unavailable sources return status 'unavailable', paid-gated sources return 'needs_config' rather than a filler score
How success is measured: Absence of fabricated scores, clarity of the unavailable/needs-config signals
AI Capability
Named Security Findings
See exactly which header and TLS checks passed and which failed — not just a grade, but the reasons behind it
Business outcome
The stripe.com report showed 8 passing and 2 failing header checks by name — actionable, not just a letter
Under the hood
each module returns findings[] with per-check pass/fail and titles (e.g., '8 header check(s) passed', '2 header check(s) failed') alongside the aggregate grade
How success is measured: Findings completeness, correctness of pass/fail attribution
Results & Metrics
Audit coverage
ImprovedBefore
Separate tools for headers, TLS, page quality, and accessibility
After
One scan covering all four dimensions, each independently graded, from a single /api/scan call
Verified grading
ImprovedBefore
N/A
After
stripe.com graded A+ on security headers (score 100, 8/10 checks) and A+ on TLS (score 100) — real graded output
Partial-failure honesty
ImprovedBefore
Scanners that substitute filler scores for checks they can't run
After
Unmeasurable sources report 'unavailable' / 'needs_config' — no fabricated grades
Cost model
ImprovedBefore
Paid scans or all sources billed by default
After
Core scan free and open; paid-API sources kept off by default so the free scan still returns real grades
Resilience
ImprovedBefore
N/A
After
Core scan completed on retry after transient Cloudflare edge errors — no arbitrary timeout, honest recovery
System Overview
The architecture below is the technical foundation behind every business outcome on this page — built for reliability, low running cost, and the speed your customers feel.
Rust scanner (ark-pulse) running as a systemd service on the VPS (:3879), reachable over the public Cloudflare route. POST /api/scan {url} fans out to independent graded modules — TechDoctor Header Review (CSP/HSTS/cookies/CORS), TechDoctor TLS Review (TLS/certificate grade), page quality, and accessibility — and aggregates per-source grade, score, and findings. Each module reports its own status so unavailable or paid-gated sources degrade honestly rather than returning fabricated scores. Also exposes /api/capture. Retry-on-transient-failure aligned with the no-arbitrary-timeout doctrine.Technologies Used
Rust, TLS/certificate analysis, HTTP header inspection, systemd, JSON API