Version 2 separates target health from evidence availability. A collector timeout, upstream outage, or unsupported lookup becomes inconclusive, never a failed target check.
| Category | Overall weight |
|---|---|
| DNS | 25% |
| TLS | 25% |
| Security headers | 20% |
| Third-party risk | 15% |
| Reachability | 10% |
| Routing | 5% |
Category percentages use only conclusive check weights. A category grade is withheld below 60% coverage; the overall grade is withheld below 70% weighted coverage. Reports expose the scoring version and coverage so saved baselines remain interpretable.
Root Cause Mode correlates DNS resolution, TLS connectivity, HTTP response, BGP visibility, detected infrastructure providers, and active provider incidents. Its layer and confidence are hypotheses backed by the displayed evidence—not a substitute for internal telemetry.
Measurements originate from Cloudflare’s network and public data providers. Geographically selective failures, authentication-gated pages, client-side consent flows, and private infrastructure may require additional testing.