Don't take our word for it. Check for yourself.
Four independent, free tools measure what a promise can't: encryption, security headers, accessibility, and performance. The result never depends on who's presenting it.
Our own results
We run all of this on ourselves first.
Before offering you these tools, we ran them on ourselves. Try them yourself just below, on the site you're reading right now.
No need to wait for a quote
Check a domain, two different ways.
Test a site right now
Enter a domain and run it through the four independent checkers below. Nothing is sent to AXIOM TrueNorth.
These tools belong to Qualys, Scott Helme, WebAIM, and Google respectively. They're independent of AXIOM TrueNorth, free, and require no account.
Server diagnostic
Our server connects directly to the domain you enter and shows exactly what it finds, as measured findings.
This diagnostic connects directly to the domain you provide. No data is kept beyond the calculation itself.
What's actually measured
Four angles, zero cosmetics
SSL Certificate
- What's tested
- TLS version, algorithm strength, chain validity
- Why it isn't cosmetic
- A closed padlock doesn't rule out a vulnerable setup
- Target
- A+
Security Headers
- What's tested
- HSTS, CSP, X-Frame-Options, and more
- Why it isn't cosmetic
- These headers block entire families of attacks
- Target
- A
Accessibility
- What's tested
- Contrast, alt text, HTML structure, keyboard navigation
- Why it isn't cosmetic
- An inaccessible site shuts out a real share of its visitors
- Target
- 0 critical errors
Performance
- What's tested
- Load time, resource weight, optimization
- Why it isn't cosmetic
- A slow site loses visitors before they've even read it
- Target
- >90
The first two checks map directly onto the Security layer detailed on the Estimate page: never a stated add-on, it's actually measured.
A header already being sent, not a promise
What this site never asks your browser for.
Every response from this server carries a Permissions-Policy HTTP header that disables, by default, access to five sensitive browser features — not just for this site, for any resource it might load. You can verify it in the Network tab of any browser, on any page of this site.
- geolocation=()
- No script on this site can ever request your location, now or later.
- microphone=()
- Your device's microphone cannot be activated by any page on this site.
- camera=()
- Your device's camera cannot be activated by any page on this site.
- payment=()
- No payment request can be triggered from this site: it doesn't offer one anyway.
- browsing-topics=()
- Disables Chrome's Topics API (FLoC's successor), consistent with the 0 tracking cookies already stated in the privacy policy.
The empty parentheses (()) are the strictest form of this directive: they mean "forbidden to absolutely everyone," including this site itself, never just a restriction on third parties.
A score, not a trophy
A number taken at one point in time. Not an eternal guarantee.
An SSL certificate expires. A software library accumulates flaws over time. A score measured today says nothing about its state six months from now, unless it's checked again — which is what the optional subscription detailed on the Estimate page covers.
The scores shown higher up on this page are measured, not stated — identical that day, whichever plan is chosen.
The certificate is approaching expiration. A security update is still pending.
The certificate is renewed before it expires. Headers are re-checked after every change to the site.
The next check, if there is one, will be yours — after something has already stopped working.
The score measured on day one still holds: checked again, never just assumed.
These targets are aimed for before any delivery, whichever plan is chosen. If a design flaw keeps them out of reach, the 30-day correction guarantee under Article 5 of the Terms of Sale applies.
Ran the test? Let's talk about the gap.
If the site you tested doesn't check these boxes, a tailored quote shows exactly what needs to change.