Methodology
Janus runs a small set of passive, read-only checks against the public-facing side of a domain — the same information any visitor's browser or any DNS resolver can already see. Nothing here requires credentials, and nothing here writes to or modifies the target in any way.
Transport Security
Checks the certificate and negotiated protocol/cipher on your public HTTPS endpoint — whether the certificate is valid and trusted, and whether the server still accepts outdated, weak TLS versions or ciphers.
Why it matters: This is the padlock in your visitors’ browser. An expired or misconfigured certificate shows a scary warning that kills trust instantly, and outdated encryption can fail payment-compliance requirements.
HTTP Security Headers
Checks response headers like Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, and cookie flags — the browser-enforced protections a site opts into by sending the right headers.
Why it matters: These are extra locks the browser enforces on your behalf, stopping a small vulnerability elsewhere on your site from turning into stolen customer data — and they’re a baseline hygiene check many B2B buyers now expect.
DNS & Email Security
Checks SPF, DMARC, and DNSSEC records — the DNS-level controls that make it harder for someone to spoof email from your domain or tamper with DNS responses in transit.
Why it matters: SPF and DMARC stop someone from sending fake invoices or phishing emails that look like they’re from your company, and keep your real emails out of spam. DNSSEC additionally protects against attackers tampering with DNS to secretly redirect your visitors to a fake copy of your site.
Software Hygiene
Checks publicly visible server/software identifiers (like a Server or X-Powered-By header) against known CVEs for that software, and flags anything that looks unpatched.
Why it matters: If your site reveals an outdated software version with a known vulnerability, that’s a published exploit an attacker can look up by name — not a hypothetical risk.
How grades are calculated
Each category gets its own letter grade based on the individual checks (findings) inside it. The overall grade is a weighted average across whichever categories were actually scanned — if a category couldn't be checked (for example, a scan target with no reachable HTTPS endpoint has no Transport Security category), it's excluded and the remaining categories are reweighted, not counted as a failure.