/ / d / cloudflare.com
cloudflare.com
66 / 100
overall · band: medium
Categories
Security72/ 100 · 9 measured
Performance74/ 100 · 12 measured
SEO42/ 100 · 9 measured
AI-readiness50/ 100 · 4 measured
Privacy47/ 100 · 6 measured
Accessibility60/ 100 · 7 measured
Brand presence54/ 100 · 18 measured
Email health80/ 100 · 16 measured
Site facts
- Snapshot date
- 2026-04-27
- Factors scored
- 81 / 86
- Composite score
- 66/100
- Method version
- v0.1 — 2026-04-25
Security· 72/100
| # | Factor | Verdict | Score | Evidence |
|---|---|---|---|---|
| 4 | Security headers (HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy, X-Content-Type-Options) | pass | 80 | security_headers_score=80, missing=Content-Security-Policy |
| 5 | SSL certificate validity & expiration window | n/a | — | Scoring not yet implemented |
| 6 | WordPress REST API user enumeration exposure | pass | 100 | not_wordpress |
| 7 | Sensitive path exposure (.git, .env, /admin, xmlrpc.php, wp-login.php) | pass | 100 | total_checked=6 |
| 22 | DNSSEC validation | pass | 100 | ds_present=true, ad_bit=true, ds_records={"name":"cloudflare.com","type":43,"TTL":86294,"data":"2371 ECDSAP256SHA256 2 32996839a6d808afe3eb4a795a0e6a7a39a76fc52ff228b22b76f6d63826f2b9"} |
| 23 | CAA records | fail | 0 | records=\# 38 00 05 69 6f 64 65 66 6d 61 69 6c 74 6f 3a 74 6c 73 2d 61 62 75 73 65 40 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d|\# 19 00 05 69 73 73 75 65 63 6f 6d 6f 64 6f 63 61 2e 63 6f 6d|\# 45 00 05 69 73 73 75 65 64 69 67 69 63 65 72 74 2e 63 6… |
| 26 | HSTS preload list inclusion | pass | 100 | hsts_header=max-age=31536000; includeSubDomains, preload_status=preloaded |
| 27 | TLS minimum version & cipher suite quality | warn | 70 | status=READY, grades=B|B|B, worst=B |
| 28 | Subdomain takeover surface | pass | 100 | dangling_count=0 |
| 29 | Spam / phishing blocklist presence | fail | 0 | listed=true, response_code=0, answers=127.255.255.254 |
Performance· 74/100
| # | Factor | Verdict | Score | Evidence |
|---|---|---|---|---|
| 8 | Mobile PageSpeed score + Core Web Vitals (LCP, FCP, CLS) | fail | 44 | performance_score=30, lcp_ms=15012.558388149273, cls=0.026362, components={"perf":30,"lcp":30,"cls":100} |
| 9 | HTTP/2 support | pass | 100 | perf_http2=true |
| 10 | Compression (Brotli / gzip) | pass | 100 | perf_compression=br |
| 30 | HTTP/3 support | pass | 100 | source=https_rr, supports_h3=true |
| 31 | IPv6 support | pass | 100 | aaaa_count=2, aaaa=2606:4700::6810:85e5|2606:4700::6810:84e5 |
| 32 | Image optimization (WebP/AVIF) | warn | 70 | id=image-delivery-insight, lighthouse_score=0.5, displayValue=Est savings of 193 KiB |
| 33 | Desktop PageSpeed score | fail | 44 | performance_score=44, lighthouse_score=0.44 |
| 34 | Core Web Vitals from CrUX (Real User Monitoring) | pass | 80 | overall_category=AVERAGE, lcp_ms=2973, cls_x100=2, inp_ms=474, components={"name":"lcp","raw":2973,"score":70}|{"name":"cls","raw":2,"score":100}|{"name":"inp","raw":474,"score":70} |
| 35 | Lazy loading on below-fold images | fail | 40 | id=image-delivery-insight, lighthouse_score=0.5, displayValue=Est savings of 193 KiB |
| 36 | Font loading strategy (FOUT/FOIT/swap) | pass | 100 | id=font-display-insight, lighthouse_score=1 |
| 37 | Total homepage byte weight | pass | 80 | html_bytes=982429, subresource_bytes=0, total_bytes=982429, total_kb=959, sampled=16, total_refs=16 |
| 38 | Largest unused JavaScript bundle | fail | 25 | deferred_scripts=14, sample=/_willow/index.astro_astro_type_script_index_0_lang.CdubHssI.js|/_willow/index.astro_astro_type_script_index_0_lang.C4qcez97.js|/_willow/index.astro_astro_type_script_index_0_lang.C4opSW71.js|/_willow/index.astro_astro_ty… |
SEO· 42/100
| # | Factor | Verdict | Score | Evidence |
|---|---|---|---|---|
| 11 | Title, meta description, OG, Twitter cards, canonical | pass | 80 | title=true, description=true, og=true, twitter=false, canonical=true |
| 12 | Schema.org structured data presence | fail | 0 | structured_data_absent |
| 13 | H1 tag presence | fail | 0 | h1_count=0 |
| 14 | Sitemap.xml + robots.txt presence | pass | 100 | has_robots_txt=true, has_sitemap=true |
| 39 | Schema.org type validity (parsed JSON-LD) | fail | 0 | total=0, valid=0 |
| 40 | Breadcrumb schema | fail | 0 | present=false |
| 41 | FAQ / HowTo schema (where applicable) | n/a | — | n/a — not_applicable |
| 42 | hreflang for multi-language sites | pass | 100 | html_lang=en, languages_seen=en, alternates=25, alternate_langs=en|de|es|fr|id|it|nl|ja|ko|th|tr|pl|pt|sv|vi|ru|zh|ar|he |
| 43 | Internal link depth (clicks from homepage to deepest content) | pass | 100 | max_depth=1, pages_fetched=50, pages_seen=249, capped_at=50 |
| 61 | Better Business Bureau accreditation | fail | 0 | no_link_on_site |
AI-readiness· 50/100
| # | Factor | Verdict | Score | Evidence |
|---|---|---|---|---|
| 15 | llms.txt presence | pass | 100 | has_llms_txt=true, size_bytes=4225 |
| 16 | AI crawler robots.txt directives | pass | 100 | robots_ai_blocked_count=0 |
| 44 | AI plugin manifest (.well-known/ai-plugin.json) | fail | 0 | status=404 |
| 45 | JSON-LD richness score for LLMs | fail | 0 | org_complete=false, has_address=false, has_contact_point=false, has_same_as=false, has_content_type=false, breakdown={"coreOrg":0,"contact":0,"sameAs":0,"contentType":0} |
Privacy· 47/100
| # | Factor | Verdict | Score | Evidence |
|---|---|---|---|---|
| 46 | Cookie banner presence + CMP detection | fail | 0 | banner_detected=false |
| 47 | Privacy policy page presence | pass | 100 | found=true, href=/privacypolicy/, text=PrivacyPolicy, data, and protection |
| 48 | Terms of service page presence | pass | 100 | found=true, href=/website-terms/, text=Terms of use |
| 49 | Third-party tracker count | pass | 80 | count=1, hosts=static.cloudflareinsights.com |
| 50 | CCPA "Do Not Sell or Share My Personal Information" link | fail | 0 | found=false |
| 51 | Cookie scan — actual cookies set on first load | fail | 0 | count=7, names=cf_willow_version_key|_cfms_willow|_ga|cfz_google-analytics_v4|cfz_adobe|kndctr_8AD56F28618A50850A495FB6_AdobeOrg_identity|__cf_bm, with_cmp=false |
Accessibility· 60/100
| # | Factor | Verdict | Score | Evidence |
|---|---|---|---|---|
| 52 | Accessibility statement page | fail | 0 | found=false |
| 53 | axe-core / WAVE accessibility scan | pass | 95 | accessibility_category=0.95 |
| 54 | Image alt text coverage | pass | 100 | lighthouse_score=1, failing_count=0 |
| 55 | Heading hierarchy validity | fail | 30 | lighthouse_score=0 |
| 56 | Color contrast (WCAG AA) | pass | 100 | lighthouse_score=1, failing_count=0 |
| 57 | ARIA labels presence and validity | pass | 92 | total_aria_audits=22, applicable=12, passing=11, failing=aria-hidden-focus |
| 58 | Skip-to-content link | fail | 0 | found=false |
Brand presence· 54/100
| # | Factor | Verdict | Score | Evidence |
|---|---|---|---|---|
| 17 | Domain age (RDAP / WHOIS) | pass | 100 | domain_age_years=17.2 |
| 18 | Wayback Machine site age & last snapshot | n/a | — | Scoring not yet implemented |
| 19 | Google Business Profile presence + rating | pass | 80 | found=true, rating=3.8, review_count=132 |
| 20 | News mentions in last 30 days | pass | 85 | news_mentions_count=20 |
| 21 | Wikipedia entity | fail | 0 | found=false |
| 59 | Yelp presence + rating + review count | fail | 0 | no_link_on_site |
| 60 | Trustpilot presence + rating | fail | 0 | no_link_on_site |
| 62 | LinkedIn Company Page (presence + employee count + follower count) | pass | 100 | url=https://www.linkedin.com/company/cloudflare |
| 63 | Bing Places | n/a | — | n/a — no_public_url_convention |
| 64 | Apple Maps presence (Apple Business Connect) | fail | 0 | no_link_on_site |
| 65 | Facebook Page presence | pass | 100 | url=https://www.facebook.com/Cloudflare/, live=true |
| 66 | Instagram presence (link from site → IG profile) | pass | 100 | url=https://www.instagram.com/cloudflare/ |
| 67 | Web App Manifest (manifest.json) | fail | 0 | present=false |
| 68 | Service Worker / PWA capability | fail | 0 | registered=false, reachable=false |
| 69 | Analytics tools detected | pass | 100 | tools=Cloudflare Web Analytics, count=1 |
| 70 | Payment processors detected | n/a | — | n/a — no_payment_detected |
| 71 | Marketing automation tools detected | fail | 0 | count=0 |
| 72 | Customer support tools detected | fail | 0 | count=0 |
| 73 | Tag manager presence | pass | 100 | tools=Google Tag Manager, count=1 |
| 74 | Ad networks detected | pass | 100 | count=0 |
| 83 | Visible contact form on site | pass | 100 | detected=true, count=1 |
Email health· 80/100
| # | Factor | Verdict | Score | Evidence |
|---|---|---|---|---|
| 1 | DMARC enforcement | pass | 100 | present=true, policy=reject |
| 2 | DKIM signing | pass | 100 | present=true, selector=mandrill, source=doh_probe |
| 3 | SPF record present and valid | pass | 100 | present=true, raw="v=spf1 ip4:199.15.212.0/22 ip4:173.245.48.0/20 include:_spf.google.com include:spf1.mcsv.net include:spf.mandrillapp.com include:mail.zendesk.com include:stspg-customer.com include:_spf.salesforce.com -all", qualifier=hardfail |
| 24 | MTA-STS & TLS-RPT | fail | 0 | policy_ok=false |
| 25 | BIMI + VMC | pass | 100 | record=v=BIMI1; l=https://www.cloudflare.com/cloudflare_1171114652.svg; a=https://www.cloudflare.com/cloudflare_1171114652.pem, logo_url=https://www.cloudflare.com/cloudflare_1171114652.svg, vmc_url=https://www.cloudflare.com/cloudflare_1171114652.p… |
| 75 | Branded domain email address (vs free Gmail/Yahoo) | pass | 100 | branded=true, provider=generic |
| 76 | Email provider class (Workspace / 365 / Zoho / self-hosted / shared) | pass | 80 | provider=cloudflare_area_1, mx=mxa-canary.global.inbound.cf-emailsecurity.net|mxb-canary.global.inbound.cf-emailsecurity.net|mxa.global.inbound.cf-emailsecurity.net|mxb.global.inbound.cf-emailsecurity.net, source=mx_classifier |
| 77 | DMARC aggregate reporting enabled (rua=) | pass | 100 | has_dmarc_reporting=true, audit_flag=true, derived_from_raw=true, source=derived_from_raw, dmarc_raw="v=DMARC1; p=reject; pct=100; rua=mailto:rua@cloudflare.com,mailto:cloudflare@dmarc.area1reports.com; ruf=mailto:cloudflare@dmarc.area1reports.com" |
| 78 | Free-email exposure on contact page (gmail/yahoo/outlook visible) | pass | 100 | Scored |
| 79 | Newsletter signup form detected | fail | 0 | detected=false |
| 80 | Email Service Provider (ESP) detected | pass | 100 | providers=Mandrill (Mailchimp Transactional) |
| 81 | Transactional email provider detected (from SPF includes) | pass | 100 | providers=Mandrill|Zendesk|Salesforce |
| 82 | SPF lookup count (10-limit deliverability check) | pass | 100 | lookups=7, limit=10 |
| 84 | Mailto: direct contact link present | fail | 0 | Scored |
| 85 | Email forwarding service detected (improvmx, forwardemail, etc.) | pass | 100 | hosts=mxa-canary.global.inbound.cf-emailsecurity.net|mxb-canary.global.inbound.cf-emailsecurity.net|mxa.global.inbound.cf-emailsecurity.net|mxb.global.inbound.cf-emailsecurity.net, kind=unknown |
| 86 | Lead magnet / signup incentive detected (free download, ebook, etc.) | pass | 100 | detected=true, sample=download=""><span class="learn-more f3 fw5 lh-7 mr1">Download PDF</span></a></div></div><div class="mb4 col-lg-4 col-md- |
Scores are computed under method v0.1 — 2026-04-25. See the methodology for the full factor list and per-factor specifications.