How a site is graded
The same settings always produce the same score. Below is how that score is worked out, in plain language, with the exact weight of every check at the foot of the page for anyone who wants to check it.
- We read what your site sends and what a browser sees on one real visit. We do not scan.
- Every point lost maps to something we saw. What we could not measure costs nothing.
- We check your home page, not what sits behind a login or on the rest of the site.
- The score is about what a visitor risks. Which platform you use, or how hard a fix is, does not count.
- The same site always gets the same score, and a saved report stays as it was.
From visit to score
- VisitWe open your home page once, the way a visitor does.
- ReadWe read the headers your site sends, the page the browser loads, and the public DNS records for your domain.
- WeighEvery weakness we see costs points sized to the risk for the visitor. What we did not see costs nothing.
- GradeThe points become a letter, A through F, with the evidence underneath.
What we read
- The HTTP response headers your site sends with every reply.
- Your home page as a browser loads it: what code runs, what your site fetches from external services, and what is stored on your visitor's device before there is consent.
- The secure connection and its certificate.
- The public DNS records for your domain, and the ones for email (SPF, DMARC).
What we do not do
We probe nothing for holes and send no crafted requests. That would be scanning someone else's site rather than reading it. We look only at your home page, not behind a login or across the rest of the site. We judge the settings your site sends, not the software behind them: whether your platform and extensions are up to date falls outside this score. And we do not store who ran a check.
How the score is worked out
A hundred points, minus what is wrong
Every site starts at 100. Each weakness deducts points sized to its risk, and a couple of good practices add a few back. The number is capped at 0 and 100 and mapped to a letter, A through F.
One rule decides every weight
What a weakness costs depends on whether anything protects this risk, what an attacker gains, and how far it reaches on its own. No weight is chosen by feel, and the answer for every check is set out below.
The score speaks for the visitor
The score weighs what a visitor risks, not how easily you can fix it. A site on a closed platform that cannot set a header is exactly as exposed as one that could and did not. That difference means nothing to the visitor, so it means nothing to the score. The advice underneath does meet you where you are: for each verdict we name where a fix can live, from your application to your hosting provider, often more than one place.
A saved report does not change
The same site always gets the same score. Save a report and it stays as it was, even if we change the model later: it is dated evidence, not a snapshot that drifts with us. Share the link and you keep showing what you saw. When it opens we translate the report at most.
From points to a letter
The final number, 0 to 100, falls into one of six bands. Below is which number maps to which letter.
- A: 90-100
- B: 80-89
- C: 65-79
- D: 50-64
- E: 35-49
- F: 0-34
Every check and its weight, to recalculate by hand
Every check and its weight, to recalculate by hand
Weighed once, not once per symptom
Where the basic protection for a risk is missing, that costs its whole weight and the smaller checks do not add on top. Such a check still appears in the report with its advice, because it counts again once the basics are in place. Where the basics are sound, the individual checks simply add up. We grade the shape of a policy, not the services it names.
A serious failure caps the score
Some findings put a ceiling on the score however many points the rest earns, because you cannot average your way out of them. A site that allows loose code in the page, or that answers over an unencrypted connection (http), holds the score down no matter what else is right.
No rules count as the worst rules
Sending no security rules at all is not a neutral absence. It leaves the page exactly where wide-open rules leave it, so it is graded by running that wide-open equivalent through the same checks. The number is derived, not asserted, which means the tool can never tell you that removing a security setting improves your score.
Not tested is never a failure
A check that timed out or could not run is reported as not tested, worth zero points, with the reason. Such a check says nothing about the site, and reporting it as a red cross would be inventing a result. While something could not be measured the score is also barred from the top of the scale, because counting an unmeasured gap as clean would be inventing a result just the same.
And here is what each check costs. Generated from the model itself, so this page cannot describe a scale the tool no longer uses. Points are subtracted from a hundred; a risk can never cost more than its ceiling, however many findings it holds.
Cross-site scripting (XSS)
costs at most 30 pointsIf someone gets their own script running here, everything on the page is theirs: what is typed, what is shown, and where the form goes.
- -30Nothing here is protected. That costs this risk its whole weight, and nothing further is added on top.
- 1Content-Security-Policy is not enforced
- 2script-src (and default-src) are missingat most C
- 3script-src allows any hostat most C
- 4data: in script-srcat most C
- 5'unsafe-inline' in script-srcat most C
- -10An attacker can use this on its own. Nothing else has to be wrong first.
- 6base-uri is missing
- 7blob: in script-src
- 8Shared platform in script-src
- 9A nonce or hash is missing its quotes, so it does nothing
- 10'unsafe-eval' in script-srcat most B
- -5This only works once something else is wrong too, and then it reaches everyone who opens the page.
- 11base-uri is present but weak
- 12default-src is missing
- 13Overly broad sources in other fetch directives2 points per overly broad directive, at most 5
- 14form-action is not set
- 15style-src allows overly broad sources
- 16CSP keyword without quotes
- 17External scripts arrive without a hash
- 18X-Content-Type-Options is missing or not 'nosniff'
- -2This cannot be used by itself. It makes an attack easier, or exposes your visitor to another party.
- 19object-src is not covered
- 20object-src is not 'none'
- 21'unsafe-inline' in style-src
- +3This goes beyond what is usual. It adds points rather than costing them.
- 34CSP violation reporting is set up
- 35Trusted Types are required for script
Secure connection
costs at most 35 pointsAnyone between your visitor and your server can read or change what passes. This is the one risk that needs nothing else to go wrong first.
- -35Nothing here is protected. That costs this risk its whole weight, and nothing further is added on top.
- 36Plain http is not redirected to httpsat most D
- 37TLS is absent on this URLat most F
- 38The certificate has expiredat most D
- 39The certificate is not valid for this hostnameat most D
- 40The certificate chain does not validateat most D
- -10An attacker can use this on its own. Nothing else has to be wrong first.
- 41Strict-Transport-Security (HSTS) is missing
- 42Strict-Transport-Security has no max-age
- 43The page loads resources over http
- 44Insecure resources load when the page runs
- 45TLS version is outdatedat most D
- -5This only works once something else is wrong too, and then it reaches everyone who opens the page.
- 46Cookies are set without the Secure flag
- 47A login session is readable by JavaScript
- 48Strict-Transport-Security max-age is under a year
- -2This cannot be used by itself. It makes an attack easier, or exposes your visitor to another party.
- 49Cookies are sent on requests from other sites
- 50Mixed-content protection is missing
- 51Strict-Transport-Security without includeSubDomains
Embedded in a frame (clickjacking)
costs at most 10 pointsYour page can be loaded invisibly inside another site, so a visitor clicks something other than what they see.
- -10Nothing here is protected. That costs this risk its whole weight, and nothing further is added on top.
- 61Clickjacking protection is missing
- 62X-Frame-Options has an invalid value
External parties
costs at most 10 pointsWho else runs code or receives data the moment someone opens your page, and which law reaches them.
- -2This cannot be used by itself. It makes an attack easier, or exposes your visitor to another party.
- 68Permissions-Policy is missing
- 69Referrer-Policy is missing
- 70Referrer-Policy is weak
Privacy
costs at most 10 pointsWhat runs and what is stored before anyone agreed to it, and whose law reaches the data your page sends out. Whether that is allowed depends on what it is for, which is not visible from outside.
- -10Nothing here is protected. That costs this risk its whole weight, and nothing further is added on top.
- 79Something was stored on your visitor's device before there was consent
Domain and DNS
costs at most 12 pointsWhether visitors arrive at your server at all, and whether it is really yours they reach.
- -10An attacker can use this on its own. Nothing else has to be wrong first.
- 87DNSSEC is signed but broken
- -5This only works once something else is wrong too, and then it reaches everyone who opens the page.
- 88DNSSEC is not enabled on the domain
- 89Not reachable over IPv6
Whether someone else can send mail that appears to come from your domain. The person harmed here is a recipient, not a visitor.
- -2This cannot be used by itself. It makes an attack easier, or exposes your visitor to another party.
- 98DMARC record has no usable policy
- 99No DMARC record
- 100DMARC is set to monitor only (p=none)
- 101No SPF record
- 102SPF allows any server to send (+all)
Reporting and software info
costs no pointsWhether someone who finds a problem knows where to take it, and what your response headers and your page reveal about the software you run.
- +2This goes beyond what is usual. It adds points rather than costing them.
- 112security.txt is published and current
Accessibility statement
costs no pointsAn accessibility statement, in the official register and linked on the page itself. We do not judge whether that obligation applies to you.
What we find here is reported as an observation. It costs no points, because from the outside we cannot establish that it is wrong.
Not measured
costs no pointsChecks that could not run. Nothing here is a verdict on your site.
These checks could not run. They appear in the report as not tested, with no points.
How to fix it
Concrete advice per platform, with code you can copy: