SurfaceScan™

SurfaceScan checks the page HTML and HTTP response from the URL you submit. It looks for common signs of privacy exposure and gives a score out of 100 across six areas:

• JavaScript exposure (25 points): external and inline scripts, event handlers, and framework signals.
• Cookies (20 points): cookies set in the response, their security attributes, and names matching known tracking-cookie patterns.
• Third-party resources (20 points): external scripts, frames, stylesheets, fonts, and images referenced in the HTML.
• Fingerprinting signals (15 points): selected browser APIs and known fingerprinting-library names found in the page source.
• Tracking signals (10 points): known analytics and advertising domains and common tracking-code patterns.
• Security headers (10 points): HTTPS and selected response headers, including Content Security Policy and Referrer Policy.

A higher score means fewer of the scanner's selected exposure signals were detected. The category breakdown shows what contributed to the result, so you can investigate individual findings rather than relying on the total alone.

SurfaceScan is a lightweight static website privacy checker, not a full browser audit. It fetches the submitted page server-side, reads its response headers, and inspects up to 256 KB of returned HTML. It does not run JavaScript or interact with the page.

That means it can miss requests, cookies, or tracking behaviour created after the page loads, behind a consent choice, or through user interaction. It may also give an incomplete picture of JavaScript-rendered sites. Its checks use selected patterns and headers, so a clean result is not proof that a site collects no data or is secure.

Treat the score as a quick first look, not a certification or legal assessment. If you manage the site, use the findings to decide what to verify in a real browser and in your own network and privacy reviews.