Site and profile
Without it only the passive checks apply: what any visitor's browser can see. Testing a system without permission is a crime in many countries.
Status
Change control
A check can be marked Fixed only after the pre-change list is acknowledged, and the run closes only after the post-change matrix is. Record "before" once the diagnosis is done, so the report can compare.
Pre-change list
Read with the owner before the first change.
Before
Post-change matrix
After each change that touches forms, cache, PHP, the theme or the database, and always at the end.
Close the run
Incident runbook
For a compromised site. Six phases in order; a step can be ticked only after the steps it needs, and each tick keeps its time. Real passwords are rotated only once the site is isolated and every administrator is locked out, so a collector still running on the site cannot take the new ones.
Timeline
Reports and data
Export
The before and after report needs "before" recorded in Change control.
Import
It replaces the run open now. Export that one first if you need it.
Start over
States and colours
Each check is in one of seven states. The colour is derived from the state, the check's priority and its area, never chosen. A pass with no evidence note counts as not checked.
The code and the method's tables are in github.com/Fedemedinilla/applied-ai-toolkit.