Sites that earned an A, and chose to say so.
Every domain below passed a fresh, passive StealthMark audit with grade A or A+ and was confirmed from a mailbox at that domain. The Public Index further down counts how common each check is across a named list, without naming anyone.
Hall of Fame
Best score first, then the earliest confirmation. Audits older than 90 days drop off.
| # | Domain | Grade | AI-Phishing & Session Hijack Resistance | Score | Certificate |
|---|---|---|---|---|---|
| 1 | stealthmark.io | A+ | 🛡️ Active Shield Protected | 100 | Verify Live → |
Claim your spot
We run a fresh audit now. At A or A+, we email a confirmation link to the address you enter, which must be security@, webmaster@, hostmaster@, postmaster@ or admin@ at the domain itself. Nothing is published until you confirm.
Public Index
How common each passive check is across a named list of domains, as a share of the domains audited.
- Edition
- 2026-10 · generated 2026-10-29
- Domains
- 80 audited of 80 listed
- Source list
- 80 B2B SaaS, developer-tool and AI domains hand-picked by StealthMark from the Tranco list
- sha256 of the audited domains
- ab8649d03996c47856f981d7e84898f970c9688df3153b33408fd102f9e28b79
- Lowercase, sorted, one per line, no trailing newline.
| Check | Pass | Warn | Fail | Other |
|---|---|---|---|---|
| HTTPS available | 99% | 0% | 1% | 0% |
| HTTP redirects to HTTPS | 99% | 0% | 0% | 1% |
| Strict transport downgrade lock | 80% | 19% | 0% | 1% |
| Trusted PKI certificate chain | 99% | 0% | 0% | 1% |
| Certificate authority issuance lock | 43% | 0% | 0% | 58% |
| Sender origin authentication | 98% | 3% | 0% | 0% |
| Executive mail anti-spoofing lock | 84% | 16% | 0% | 0% |
| Runtime script execution lock | 6% | 93% | 0% | 1% |
| MIME-sniffing containment | 53% | 46% | 0% | 1% |
| Cross-origin referrer privacy | 41% | 0% | 0% | 59% |
| Clickjacking protection | 66% | 33% | 0% | 1% |
| robots.txt | 90% | 10% | 0% | 0% |
| AI crawler rules in robots.txt | 16% | 0% | 0% | 84% |
| Sitemap declared in robots.txt | 83% | 0% | 0% | 18% |
| /llms.txt | 76% | 0% | 0% | 24% |
| /.well-known/agent.json | 0% | 100% | 0% | 0% |
| Schema.org JSON-LD | 66% | 0% | 0% | 34% |
| AI citation metadata | 86% | 0% | 0% | 14% |
Auditor: StealthMarkAuditor/2.0 (+https://stealthmark.io/docs)
Rules
Hall of Fame
- Opt-in only. A domain appears after a fresh audit grades it A or A+ and someone with a mailbox at that domain confirms the listing.
- No domain below A is ever named, here or anywhere else on StealthMark.
- Nobody pays to be listed, to rank higher or to be removed.
- Each entry drops off 90 days after its audit. Claim again with a new audit to stay listed.
- The removal link in the latest confirmation email takes the domain off the list at any time. You can also write to security@stealthmark.io from an address at the domain.
Public Index
- Published as dated editions over a named list of domains. Each edition names the list and publishes the sha256 of the domains that returned a report, never the domains.
- Only non-destructive executive posture categories are aggregated across transport cryptography, brand identity, runtime session isolation, and AI agent boundaries.
- Granular vulnerability vectors, exposed paths, leaked secrets, and remediation blueprints are never published in the public index.
- Editions are never rewritten. A correction ships as a new edition.
Audits identify themselves as StealthMarkAuditor/2.0 (+https://stealthmark.io/docs) and execute non-destructive read-only evaluations across the 10 Tactical Domains of StealthMark v6.0 (100 total controls: 75% Active Edge & Browser RASP readiness + 25% External Posture Recon). Specific probe paths, rule signatures, and remediation configurations remain sealed inside the domain owner's self-serve Remediation Vault.