Crawley
Home Pricing Free Sample Audit Waitlist

METRIC

Every check Crawley runs, scored across the six METRIC dimensions - Measurement, Energy, Time, Resource, Immediacy, Cost - each 1–10. The hexagon's shape is the point, not just its size: two checks can have the same total score but a completely different priority fingerprint. Note on Cost: the hexagon plots it inverted (a big Cost wedge means cheap to fix, matching every other axis where bigger = stronger argument to prioritize) - the number shown underneath is the true cost estimate as stored, where higher genuinely means more expensive.

METRIC
TLS certificate has expired
security 49/60
M9 · E8 · T8 · R6 · I10 · C2 (raw)
Details →
METRIC
Outdated WordPress core
security 38/60
M9 · E7 · T4 · R2 · I9 · C3 (raw)
Details →
METRIC
TLS certificate expires very soon
security 36/60
M8 · E5 · T3 · R3 · I8 · C1 (raw)
Details →
METRIC
Outdated plugins
security 36/60
M9 · E6 · T3 · R2 · I8 · C2 (raw)
Details →
METRIC
PHP version no longer supported
security 36/60
M8 · E7 · T4 · R3 · I8 · C4 (raw)
Details →
METRIC
Backup/database file in the public webroot
security 35/60
M9 · E4 · T2 · R2 · I9 · C1 (raw)
Details →
METRIC
Sensitive file publicly accessible
security 35/60
M9 · E4 · T2 · R2 · I9 · C1 (raw)
Details →
METRIC
Public debug/error log exposed
security 34/60
M9 · E4 · T2 · R2 · I8 · C1 (raw)
Details →
METRIC
Plugin or theme needs a newer PHP
security 32/60
M7 · E6 · T3 · R2 · I7 · C3 (raw)
Details →
METRIC
Mixed content: insecure HTTP resources on HTTPS page
security 31/60
M9 · E3 · T2 · R2 · I6 · C1 (raw)
Details →
METRIC
Outdated themes
security 31/60
M7 · E5 · T3 · R2 · I6 · C2 (raw)
Details →
METRIC
HTTP does not redirect to HTTPS
security 30/60
M8 · E3 · T2 · R2 · I7 · C2 (raw)
Details →
METRIC
CORS allows any origin (Access-Control-Allow-Origin: *)
security 29/60
M7 · E5 · T3 · R4 · I5 · C5 (raw)
Details →
METRIC
Updates blocked by the PHP version
security 29/60
M6 · E5 · T3 · R2 · I6 · C3 (raw)
Details →
METRIC
Debug or admin utility file left in the webroot
security 28/60
M7 · E3 · T1 · R1 · I7 · C1 (raw)
Details →
METRIC
Missing Content-Security-Policy header
security 27/60
M7 · E6 · T3 · R4 · I4 · C7 (raw)
Details →
METRIC
Missing Permissions-Policy header
security 24/60
M5 · E4 · T2 · R2 · I3 · C2 (raw)
Details →
METRIC
Missing Referrer-Policy header
security 24/60
M5 · E3 · T2 · R2 · I3 · C1 (raw)
Details →
METRIC
Directory listing enabled
security 23/60
M6 · E2 · T1 · R1 · I4 · C1 (raw)
Details →
METRIC
Missing HSTS header
security 22/60
M5 · E2 · T1 · R2 · I3 · C1 (raw)
Details →
METRIC
Missing clickjacking protection
security 22/60
M5 · E2 · T1 · R2 · I3 · C1 (raw)
Details →
METRIC
Server header exposes version number
security 21/60
M4 · E3 · T2 · R2 · I2 · C2 (raw)
Details →
METRIC
Missing X-Content-Type-Options header
security 16/60
M3 · E1 · T1 · R1 · I1 · C1 (raw)
Details →