Best Practices Checker

Checks whether a domain publishes the standard policy and convention files a mature security program would: a security.txt disclosure policy (RFC 9116), a well-known password-change URL, MTA-STS and TLS-RPT mail transport security, and robots.txt. These are process and hygiene signals, not vulnerability findings — pair with the Exposed File Checker for that.