Questions, answered

Does a low grade mean a site is vulnerable?

No. It means header-level defenses were not observed or were partially configured in the scanned response.

Can a major website receive a warning?

Yes. Complex sites may use compatibility policies, return different headers by region, or intentionally accept a defense-in-depth tradeoff. ShieldCircle explains the evidence instead of claiming exploitation.

Does ShieldCircle retain URLs?

The application does not store scan history. Production infrastructure may create short-lived operational logs; target identifiers are hashed by the application.

Why can results change?

Headers can vary by CDN edge, request headers, experiments, authentication, redirects, and deployment changes.

May I scan any website?

Use the service only for lawful, authorized assessment. Respect target terms, rate limits, and applicable law.