What does an attacker see?

We'll check your certificate, security headers, domain, checkout uptime, platform and every third-party script — the same things anyone on the internet can see. Nothing invasive.