Every rule, published.
The full scale, so you can recompute your own grade. A score nobody understands is worth nothing.
The principle
Every scan starts at 100 points. Each finding subtracts an amount that depends on two things: its severity, and the weight of the family of checks it belongs to. The score never goes below zero.
Family weights
The six scored families share the 100 points as follows. The technology fingerprint has no weight: it is purely informational.
30 points
Security headers
Content-Security-Policy parsed directive by directive, HSTS, nosniff, framing protection, Referrer-Policy, Permissions-Policy, chatty headers.
20 points
TLS and certificate
HTTPS availability, working redirection, certificate expiry, name coverage, complete chain, accepted protocol versions.
20 points
DNS and email
SPF and its lookup limit, DMARC and its policy, DKIM, DNSSEC, CAA, presence of MX.
15 points
Exposure
Well-known public paths: .env, .git, backups, phpinfo, directory listing, security.txt.
10 points
Cookies
Secure, HttpOnly, SameSite, domain scope — with particular attention to cookies that look like a session.
5 points
Page content
Mixed content, target="_blank" links without noopener, cleartext forms, third-party scripts without SRI, revealing comments.
0 points
Technology fingerprint
Informational findings cost nothing
What a finding costs
A finding costs a fraction of its family's weight:
| Severity | Share of the weight | Example on headers (weight 30) |
|---|---|---|
| High | 40% | 12 points |
| Medium | 20% | 6 points |
| Low | 8% | 2.4 points |
| Information | 0% | 0 points |
Two caps
A family cannot cost more than its weight
Without this cap, a site missing a dozen headers would fall to zero and be indistinguishable from one serving its .git directory in the clear. A family can cost you everything it is worth, never more.
The same defect repeated costs less each time
Ten cookies missing SameSite is one setting to change, not ten problems. The first occurrence is charged in full, the following ones less and less: the multiplier is 1, then 1.25, then 1.5, then 1.75 at most. Breadth counts — more cookies means more exposure — but not proportionally.
Grade to score
The six grades on a ruler from 0 to 100: each band is as wide as the scores it covers.
- F0 to 39
- E40 to 54
- D55 to 69
- C70 to 79
- B80 to 89
- A90 to 100
Information findings cost nothing.
A finding marked "information" subtracts no points. That covers the technology fingerprint, the cookie inventory, and above all any check that could not conclude — such as DKIM, whose selector is not guessable from the outside. We would rather write "not determined" than "absent": the difference matters, and it saves you looking for a problem that does not exist.
A worked example
A site with no Content-Security-Policy (high, headers) loses 0.4 × 30 = 12 points. If it is also missing nosniff (medium) it loses another 0.2 × 30 = 6 points, and with no Referrer-Policy (low) 0.08 × 30 = 2.4 points. Total: 20.4 points off the family's 30, giving a score of 79.6 rounded to 80 — a B, if everything else is perfect.