See what HIP checks and why it matters.

Does the site force HTTPS? Are redirects clean? Is the certificate valid, from a trusted issuer, and not about to expire? Weak transport is a common and often fixable website problem.

Record configuration, mail-authentication posture, and a TXT-record proof that ties a domain to the person managing it. Verification is what separates a scan from a claim.

Age, history, hosting context and third-party listings. A brand-new domain is not automatically bad. It carries less evidence, and the score says so clearly.

Where forms post to, what third parties load, whether credentials are requested over insecure channels, and whether the page tries to obscure what it is doing.

Language that manufactures urgency, impersonates a provider, or pushes for credentials. These rules are the most contestable, so HIP documents them openly and allows appeals.

SSL Labs, Google Safe Browsing and VirusTotal feed in as attributed signals. HIP records which provider said what, and when, so a verdict can be traced to its source.

Rules you can read, argue with, and change.

Detection rules and their weights are plain configuration in the repository. Propose a change, discuss it in the open, and see the effect on real scans before it ships.

Every scored domain keeps an audit history: what changed, when, and which rule version produced it.