Security audit
Security audit
Section titled “Security audit”The Security tab of the dashboard answers a different question than the rest of MetriXs: not “how many visitors did I get”, but “how safe is my site”. It combines a deterministic security audit of your own site with the blocked-bots breakdown, so you can see both how well your site is configured and what MetriXs is already filtering for you.
What the audit scans
Section titled “What the audit scans”The audit fetches your site’s homepage over HTTPS (plus a plain-HTTP probe to check the redirect) and inspects the response headers and HTML. It never executes JavaScript and never sends your content anywhere: the scanner runs on MetriXs’ own infrastructure.
Three categories are scored:
| Category | Checks |
|---|---|
| Transport & encryption | Site reachable over HTTPS, HTTP redirects to HTTPS, no insecure (http://) assets on the page |
| Security headers | HSTS, Content-Security-Policy, X-Content-Type-Options: nosniff, frame protection (X-Frame-Options or CSP frame-ancestors), Referrer-Policy, no server version disclosure |
| Cookies | All cookies marked Secure, all cookies have a SameSite attribute |
Each check is a pass, a warn, or a fail with a short detail line. If your site sets no cookies at all, the cookie category scores full: MetriXs is cookieless, and sites that keep it that way get the credit for it.
Scores and history
Section titled “Scores and history”The overall score is the average of the three category scores. Every run is stored, so the card shows your score history and the change since the previous audit. Re-running is throttled to once per hour.
The security audit is a Team, Pro, and Agency feature. The tab itself is visible on every plan (see below), and the audit card shows an upgrade prompt on smaller plans.
Blocked bots
Section titled “Blocked bots”The Security tab also hosts the Blocked bots card: how many bot requests MetriXs dropped in the selected period, with breakdowns by reason, country, and page, plus a trend over time. Blocked requests never count toward your stats. See Bot detection for how the filtering works and which reasons exist.
MCP access
Section titled “MCP access”If you use the MCP server, the get_security_audit tool
returns the latest stored audit result. It is read-only: running a new scan
is done from the dashboard, not from your AI assistant.