This release focuses on making scan results more accurate and actionable, especially when a site is protected by an edge layer or when key signals live outside the exact hostname you scan.
More accurate scan results when hosts block requests
Preflight now distinguishes between a site that is down and a host that refused the scan with a real HTTP response (such as 401, 403, or 429). This helps you quickly tell when the right fix is allowlisting the scanner or adjusting protection rules, rather than treating it like an outage.
The security headers check also avoids grading headers from bot-protection or auth-wall responses, since those headers come from the edge, not your application.
Fixes for email auth and legal-page detection
Email authentication checks for SPF and DMARC now fall back to the organizational domain when the scanned host is a subdomain like www. This prevents false “missing SPF/DMARC” reports when records are correctly published on the parent domain, as DMARC expects.
The legal pages check now follows common layout include patterns so it can find privacy and terms links that live in included footers. This fixes cases where legal links existed, but were missed because the footer template was pulled in via an include rather than being in the main layout file itself.
Fewer false positives in debug statement scanning
Build scripts like gulpfile and gruntfile are now excluded from debug statement scanning. This reduces noise from console output that is meant for the terminal and never ships to users.