How to Read the Shield Report
Shield checks the site not as a search bot, but as a security scanner: it looks for access leaks, traces of hacking, vulnerable components, and configuration errors. In the catalog, 79 checks are available in twelve categories, each finding has a danger level, a CVSS score, and a link to the CWE and OWASP classifiers.
Five Levels
| Level | What It Means in Practice |
|---|---|
| Critical | The site is compromised or access is exposed — respond today |
| High | There is a working path to capture or infection |
| Medium | Facilitates an attack or exposes unnecessary information |
| Low | Minor configuration issues |
| Informational | Not a problem, but an observation: something is missing, but it is not essential |
What Is Checked
| Category | Examples of Findings |
|---|---|
| Malicious Code | Injected script, payment data skimmer, miner, hidden links, cloaking |
| Backdoors | Web shell, unauthorized administrator, modified core files, suspicious uploads |
| Leaks | Open .env and .git, backups, files with access, phpinfo, directory listings |
| CMS | Open installer, vulnerable and abandoned components, exposed version |
| DNS and Mail | SPF, DMARC, DNSSEC, possibility of subdomain interception |
| Connection | Certificate, protocols, mixed content |
| Headers and Cookies | HSTS, CSP, clickjacking protection, cookie flags |
| Injections and Access | Signs of SQL injections, overly open CORS, accessible admin panel |
Three Scanning Modes
Free — passive: looks at what the site provides itself, without probing addresses. Deep — additionally checks about one and a half hundred characteristic paths. Full — about six hundred. The wider the probing, the higher the chance of finding a forgotten backup or open installer. Current prices are on the “Rates and Prices” page.
How to Read the Score
The overall score Grade A–F is based on the issues found, taking their weight into account. A score below average almost always means one of two things: either unnecessary files are open, or headers are not configured. Both can be fixed without redesigning the site — see leak analysis.