This translation has not been editorially reviewed yet. The German version is authoritative. Deutsche Fassung →
Nothing detected doesn't mean secure
A result of 100 points means: nothing unfavourable is detectable from outside. It explicitly does NOT mean the installation is secure, current, or maintained. This boundary is stated in the rule set itself, too.
- The audit service looks exclusively at what the page delivers on its own. An outdated installation that hides its version gets a full score here — and is still outdated.
- That's why the measurement core treats "nothing detected" as its own finding type, and explicitly not as confirmation. The same stance holds across the whole service: an empty check counts as an error, never as a free pass.
- Anyone who needs a statement about the actual condition needs access to the system — a completely different kind of check, which this service deliberately doesn't offer.
FAQ
Can we assume a secure system with 100 points?
No. The score describes what's detectable from outside. It says nothing about the internal state — that would need access to the system.
Why does this audit area never assign the "critical" level?
Because it can't know whether a visible version is actually exploitable. The highest level is "severe", and that only applies with documented end of maintenance.