AdminKit status badge: what it shows and what it does not
An AdminKit status badge is a small image that shows the live status of one verified asset as AdminKit last recorded it: protected, issue detected, or unknown until a check result exists. It is a status indicator, not a certification, and its owner can revoke it at any time from their AdminKit account.
By AdminKit team, Netbase JSC · Updated
What does an AdminKit status badge show?
The badge reads "AdminKit" on the left and one of three words on the right. The word comes from the latest check result recorded for the one asset (a domain, an IP address or a service) the badge was created for:
| Word | Colour | What it means |
|---|---|---|
| protected | Green | The latest check result recorded for the asset passed. |
| issue detected | Red | The latest check result recorded for the asset reported a failure or an error. |
| unknown | Grey | No check result has been recorded for the asset yet. Every new badge starts here. |
Hovering over the badge shows the short summary of that latest result. Clicking it opens this page. The image never contains the asset's domain or IP address, the organisation's name or any finding details.
How is the badge produced?
An organisation adds an asset to its AdminKit account and proves it owns it, for example with a DNS TXT record. From the Badges screen it can then create a badge for a verified asset. AdminKit returns an image URL on api.adminkit.net and ready-to-paste HTML and Markdown that wrap the image in a link to this page.
Each time the image is loaded, AdminKit looks up the asset's latest recorded check result and draws the matching
word as an SVG image, in the same flat style as the Shields.io
badges common in READMEs. The response carries Cache-Control: max-age=60, which
MDN describes
as fresh for 60 seconds after it is generated, so a copy can be up to about a minute old.
The word changes only when a new check result is recorded for the asset. AdminKit does not re-check assets on a schedule yet, so "live" means "as last recorded", not "checked a moment ago". The checks themselves are the same kind the free security basics tools run, such as TLS, HTTP header and open-port checks.
What does the badge not prove?
- It is not a security audit, a certification or a compliance attestation.
- It covers one asset and only the checks recorded for it, not the rest of a site, network or company.
- It does not say when the latest check ran. A green badge can reflect a result from some time ago.
- It does not prove that the page showing it belongs to the asset's owner. Anyone who copies the image URL can embed it elsewhere, so the owner should revoke a badge that is being misused.
How do you add or revoke a badge?
Sign in and open Assets Workspace > Badges. Pick a verified asset to create a badge, then copy the HTML or Markdown snippet into a website or README. To remove one, choose Revoke and confirm. The image URL then answers 404 and the embedded image breaks. Cached copies, for example the image proxy GitHub uses for README images (GitHub's docs on anonymized URLs), can show the old image briefly.
Deleting an asset also deletes every badge for it. Developers can manage badges through the
AdminKit API (/v1/badge/tokens) with the same rules.
Frequently asked questions
Does a "protected" badge mean a site is secure?
No. It means the latest check result AdminKit recorded for that one asset passed. It is not an audit, a certification or a guarantee, and it says nothing about parts of the site or network that were not checked.
Why does a badge say "unknown"?
Because no check result has been recorded for the asset yet. A new badge always starts as unknown, and it keeps that word until a check result exists. AdminKit does not yet re-check assets on a schedule, so it can stay unknown for a while.
Can someone find out which site or organisation a badge belongs to?
Not from the badge. The image and its tooltip never contain the asset's domain or IP address, the organisation's name or any finding details. Anyone who has the badge URL can see its current word, so it should only be embedded where its owner wants that word shown.
What happens to a badge after it is revoked?
The badge URL stops working (the API answers 404), so the image breaks wherever it is embedded. The image is served with Cache-Control: max-age=60, so a browser or an image proxy may keep showing a cached copy for a short time.