EDIT 2 (48h later — shipped based on your feedback after a rough and a good night of sleep):

Should be fixed: - Hybrid Geoip + ASN detection (no more nsa.gov/google.com false positives) - AWS, Azure, Google Cloud, Cloudflare, DigitalOcean, Vercel, Netlify detection - Links vs embeds — href to Twitter ≠ dependency on Twitter - Lazy-loaded YouTube/Vimeo (lite-youtube facades) - Adequacy tier scoring — UK, Switzerland, Japan get -15 (trusted, not sovereign) instead of 0 - Unquoted iframe detection (LinkedIn embeds)

gov.cn no longer scores 100%. admin.ch no longer scores 100%. The "sovereignty" label now hopefully means something.

Still open: - DNS/registrar checks (v2) - One reported LetsEncrypt cert error (can't reproduce)

Details on Vercel: I try to detect via response headers (x-vercel-id), so custom domains are hopefully flagged correctly. Cloudflare for DNS is intentionally not pennalized — it's a proxy layer, not hosting (that was also stated in the methodology-popup from the beginning). I try that the origin server determines your hosting score.

Thanks to everyone who took the time. We (meaning all of you, who tested, tried and commented and maybe I, myself) made this tool hopefully significantly better.

And to have it stated here too: Though it might sound ironic or something (especially via a board like this): I and my partner never meant to insult anybody. We have profound respect for quality engineering outside of our borders. It even inspires us.