Methodology

How Insight evaluates your website.

From the server response and rendered page to scores, findings and priorities. See what was measured, what was missing and how to read the report.

Check your website Explore the method

Methodology v1.3Updated: 3 Oct 2026Changelog

01Source before score

Every finding should show where its signal came from.

02N/A stays N/A

Missing data is neither a zero nor a passed check.

03A repeatable measurement

Scope, device and method version must be known.

01 / Score

From signal to score.

Each module uses completed checks. Weight reflects the impact of a problem, while missing data stays visible as N/A.

01Source data
Lab measurement, server response, rendered DOM, crawl
02Threshold
Compared against a public standard or reference configuration
03Finding
pass · warn · fail, or N/A when data is missing
04Score 0–100
Weighted aggregation of a module’s checks

Example finding

Missing HSTS

One check shows the signal source, the rule applied and its effect on the assessment.

Security P1

Signal: missing Strict-Transport-Security header
Source: HTTP response
Rule: OWASP Secure Headers
Scope: entire domain
Confidence: high
Severity: high
Module impact: fail · high weight · 0 pts from this check

Score aggregation rules

A module score comes from available, completed checks. N/A checks are neither a pass nor a zero and do not enter the denominator.

Module score

Points from completed checks ÷ sum of those check weights × 100. Fail = 0 for that check, warn = partial weight, pass = full weight.

N/A outside the denominator

A missing signal does not lower the score and is not counted as a pass. We show N/A separately so “not measured” is never confused with “zero”.

Overall score

Combines measured module scores using the weights of the published methodology version, then applies the risk gate. An N/A module does not enter that aggregation.

Risk gate

One very weak module limits the whole score. When the weakest measured module scores below 50, the overall score is capped at 69; below 40, it is capped at 59. An N/A module does not trigger the gate. A module whose measurement is flagged as unreliable (for example a Lighthouse run that stayed anomalous after a re-measure) keeps its weight in the average but cannot cap the score.

Priority ≠ score

P1–P4 orders the implementation backlog. It does not map 1:1 to score points, because severity, scope and confidence set priority separately.

Weights and aggregation

Checks do not count equally: the weight depends on impact (high > medium > low). A passed check earns its full weight, a warning part of the points, a failure zero. A module score is earned points over maximum points, scaled to 0–100.

Missing data (N/A)

A module or check without data is reported as N/A and excluded from the denominator. The score covers only the measured scope and coverage. A deeper scan level adds modules and scope, but does not rewrite verdicts of checks already measured.

02 / Data

Start with the source.

Lab measurements, HTTP responses, automated detection and CO₂e estimates have different limits. A report should distinguish them.

Lab measurement

Lab performance metrics

Lighthouse / PageSpeed API

Source limit: Results may vary between runs

Direct measurement

HTTP checks

Statuses, headers, redirects, cookies

Source limit: Server state at scan time

Automated detection

WCAG tests

Automated, on the rendered DOM

Source limit: Some criteria require manual review

Model estimate

CO₂e estimate

The SWDM v4 model based on data transfer

Source limit: Not an emissions measurement or a certificate

First-party data

Crawl

Links, sitemap.xml and a manual list, the page is rendered with JS

Source limit: Page limit per plan; recurring issues are grouped into one finding with its scope

Two analysis inputs

Insight does not install a script on the site. It reads what the browser shows and what the server returns, in one scan session.

Rendered page

A real browser, JS, DOM and what the user actually sees.

Server response

Statuses, headers, redirects and cookies at scan time.

No script on the client site

03 / Thresholds

Thresholds have sources.

Checks use thresholds from source standards. You can cite those standards in your client report.

Module score

0–100

< 50high priority

50–69significant issues

70–89needs work

≥ 90good standing

The Insight score is not a Lighthouse score, a compliance certificate or a legal opinion. It is our interpretation of source thresholds on a shared 0–100 scale.

Example source thresholds

Core Web Vitals

LCP: ≤ 2.5 s
INP: ≤ 200 ms
CLS: ≤ 0.1

Chrome UX / web.dev

WCAG 2.2 (AA)

Text contrast: ≥ 4.5:1

W3C

Security headers

CSP: present
HSTS: present
Guidance: OWASP

OWASP

04 / Priorities

A score is not a repair plan.

P1–P4 is implementation order, not a synonym for severity. Severity comes from the threshold; priority combines severity, scope and confidence. P1 is not always a critical defect. Sometimes it is a wide, high-confidence issue. Implementation cost is only an auxiliary recommendation.

What sets the order

SeverityComes from the threshold, so the same problem gets the same severity.

ScopeAffected page count moves a finding along the P1–P4 scale.

ConfidenceAutomated detection confidence affects position on the scale.

Implementation costAn auxiliary recommendation. It does not lower severity.

P1–P4 scale

P1Fix first

P2Plan it

P3Fix when convenient

P4Backlog / low

N/A: not enough data. Never zero or success.

Another example: text contrast

Contrast below 4.5:1 · P2

Signal: text below WCAG AA 4.5:1
Source: rendered DOM
Rule: WCAG 2.2 · 1.4.3 Contrast (Minimum)
Scope: 2 pages
Confidence: high
Severity: medium
Module impact: fail · medium weight · 0 pts from this check

05 / Scan levels

Four levels, different scope.

A deeper level adds scope, but it does not change verdicts of checks already measured.

Scan levelAdded scopeModulesTimeCost

Quick

Quick screening of a single URL

No Lighthouse

Modules5

Time~1 min

Cost4 cr

Standard

Regular site quality control

Adds performance

Modules10

Time3–5 min

Cost12 cr

Complete

Audit before a release or acceptance

Security cluster (ZAP)

Modules22

Time8–10 min

Cost18 cr

Comprehensive

Extended scope for organisations

Competitors + AI Search readiness

Modules31

Time12–15 min

Cost25 cr

Understanding scan scope and cost

Each level runs a defined module set. Credit costs match the pricing page.

Module count = check suites from the published module catalog. Some suites report into a shared module (e.g. accessibility and privacy screening), so a report may show fewer sections than suites. Basic security checks (TLS, headers, cookies) run from Standard; the OWASP ZAP vulnerability cluster is added at Complete.

06 / AI

AI explains. It does not measure.

A generative model does not set the raw measurement result and does not replace source thresholds. It may help group findings and draft recommendation copy.

Measurement layer

No AI

Measurement, thresholds and severity always come from source data.

pass / warn / fail

Description layer

With AI

Descriptions, grouping and recommendations, labelled, for review.

Explaining the result

Rules for AI use in reports

Measurement without a model

Scores, thresholds and severity never come from a generative model.

AI on raw scan data

It groups findings, describes impact and drafts recommendations.

Review only

AI recommendations are labelled and nothing is applied automatically.

Complete without AI too

The score and findings list do not depend on the generative layer.

07 / Limits

What needs a separate review.

An automated scan detects some problems. These boundaries explain where its coverage ends and further review is needed.

WCAG / EAA

Does not confirm compliance

Replaces neither manual review nor legal opinion.

CO₂e

Not a measurement or certificate

An SWDM model estimate, not a lab result.

ZAP

Not a pentest

An automated vulnerability scan, not a manual penetration test.

Crawl

Not a full enterprise crawl

No guarantee of finding every URL on the site.

Lab vs CrUX

Not the same source

Shown separately, without treating lab data as field data.

See the technical crawl methodology

08 / Comparability

Compare like with like.

Page content, third-party services and network conditions can change between scans. The report records the analysis conditions. Results are compared using the same scale and thresholds.

Time and version

Scan date and methodology version

Scope

Scan level, URLs and device profile

Completeness

Modules completed and marked N/A

Method changes

Communicated, never a silent backfill

A before/after comparison in practice: the cometweb.io case study

09 / Sources

Standards and sources

Documentation for the thresholds and models used in the report. Refer to it when you need to check a rule or cite a source.

Source documentation

Core Web VitalsLCP, INP and CLS thresholdsweb.dev / Google · CWV thresholds · Thresholds Lighthouse scoringHow Lighthouse computes category scoresChrome Developers · Lighthouse docs · Scoring WCAG 2.2W3C success criteria, including AA contrastW3C · WCAG 2.2 · Criteria OWASP Secure HeadersRecommended HTTP security headersOWASP · Secure Headers Project · Headers OWASP ZAPVulnerability scanner in the security clusterOWASP · ZAP · Scanner SWDM v4Emission estimate from data transferSustainable Web Design · SWDM v4 · CO₂e model CrUXChrome UX Report field dataChrome Developers · CrUX · Field data

External links · open in a new tab · access checked Jul 2026

Changelog

Applies to reports from: 22 Jul 2026

v1.3 3 Oct 2026

Risk gate described in the aggregation rules: the 50 and 40 point thresholds and the exception for an unreliable measurement. The rule was already part of the calculation, so the description changes, not the scores.

v1.2 22 Jul 2026

Table of contents, aggregation and N/A rules, full signal→score example, explicit AI role, versioned sources.

v1.0 15 Jul 2026

First public methodology: scoring path, sources, thresholds, priorities, scan levels and limits.

See the methodology in practice.

The sample report shows the data sources, timing and limits of the analysis. The Free plan then lets you scan one project, no credit card required.

Scan a site View sample report

No credit card required Data sources in every report Thresholds from public standards