How I Score Your Website's Security (And Why I Rebuilt It From Scratch)

AmIHackable ? I tested my scanner against Mozilla Observatory on 229 sites, found I was wrong on 40% of them, and rebuilt my entire approach. Here's everything I learned. The problem: security scores that lie I built AmIHackable to give developers a clear picture of their website's security. Paste your URL, get a score, fix what matters. Simple. Except it wasn't simple. Users started telling me things like: "My site is a React SPA on Netlify. Your scanner says I have WordPress, PHP, and an exposed .env file. None of that is true." "You gave me 3/10 but Mozilla Observatory gives me B+. Your score is misleading for a site with TLS 1.3, solid auth, and zero XSS surface." "The scanner flagged dangerouslySetInnerHTML as an XSS risk — but that string doesn't exist anywhere in my code. It's in React's own bundle." These weren't edge cases. When I dug into the data, I found systematic problems. I compared my scores against Mozilla Observatory on 229 real sites. The results were uncomfortable: