What the Auditor checks and how
69 checks in 8 areas. Each has a weight in points, and every result can be repeated with public tools: the scanner reads only what anyone can see on the internet.
How the grade is calculated
- Each check has a maximum number of points (the "weight" column below). A passed check earns all of them, a partly passed one earns part, a failed one earns zero.
- An area score is the points earned divided by the points possible, on a 0-100 scale.
- The overall score is a weighted average of the areas: email and spoofing 24 %, attack surface 22 %, brand protection 14 %, website 18 %, domain and DNS 14 %, privacy and GDPR 8 %. Visibility and availability are shown but do not count toward the security grade.
- Letter: A from 90, B from 80, C from 65, D from 50, E below 50 points. A critical issue (for example no DMARC, a takeover-prone subdomain, a secret in the site code) lowers the letter to D at most.
- A check that could not be run (the server did not respond, data unavailable) has the status "not checked" and does not count toward the score. We do not guess.
Where the data comes from
- Domain DNS through public resolvers with DNSSEC validation (1.1.1.1 and 9.9.9.9).
- The home page over HTTP and HTTPS, robots.txt, sitemap.xml, security.txt, the MTA-STS policy: up to 25 requests.
- One STARTTLS connection to the mail server from the MX record, without sending a message.
- Public certificate logs (Certificate Transparency) and the domain registry (RDAP).
Limitations
- The scan sees the domain from the outside. It does not see passwords, backups, server updates, permissions or what happens inside the company network.
- DKIM can be confirmed only under a known selector. If the server uses its own selector name, we write "not checked", not "missing".
- About look-alike domains we only know that they are registered and whether they have mail; for at most three we also check the registration date, a redirect to the audited domain and the similarity of the home page. We do not know who owns them.
- Legal checks (privacy policy, cookies, company details) are heuristics on the home page.
- The result is the state at the time of the scan.
Email and spoofing 24 % of the grade, 12 checks
SPF, DKIM, DMARC, MTA-STS, mail server encryption.
| Check | Why it matters | Weight |
|---|---|---|
| Mail servers (MX) | Without valid MX records, email to your company does not arrive. | 10 pts |
| SPF: record | SPF tells receiving servers which servers may send email from your domain. Without it, messages land in spam more often and spoofing is easy. | 10 pts |
| SPF: "all" policy | The end of the record decides what happens to email from senders that are not on the list. | 8 pts |
| SPF: DNS lookup limit | SPF allows at most 10 DNS lookups. Above that, receiving servers return an error and ignore the record. | 6 pts |
| DKIM: message signature | DKIM signs every message with the domain's key. Gmail and Microsoft require SPF or DKIM, and DMARC needs at least one of them with alignment. | 10 pts |
| DMARC: record | DMARC ties SPF and DKIM together and tells receiving servers what to do with spoofed email. Without it, someone can send invoices "from you". | 10 pts |
| DMARC: policy | p=none only observes. Only quarantine or reject protects against spoofing. | 10 pts |
| DMARC: reports | rua reports show who sends email on behalf of the domain and what is rejected. | 4 pts |
| MTA-STS | It enforces TLS encryption when email is delivered to your domain. Without it, an attacker on the network can downgrade the connection to plain text. | 4 pts |
| TLS-RPT | Reports on failed TLS connections to your mail servers. | 2 pts |
| Encryption on the MX server (STARTTLS) | Without STARTTLS, incoming email travels in plain text. A bad certificate breaks MTA-STS and DANE. | 8 pts |
| Reverse record (PTR) of the MX server | Receiving servers check the PTR of the sender's address. A missing PTR raises the chance of being marked as spam. | 3 pts |
Attack surface 22 % of the grade, 4 checks
Subdomains from certificate logs, subdomain takeover risk, secrets in the website code, script integrity.
| Check | Why it matters | Weight |
|---|---|---|
| Subdomains in certificate logs | Every certificate goes into public Certificate Transparency logs, so addresses like dev., test. or admin. are visible to everyone. They are often forgotten and less protected. | 6 pts |
| Subdomain takeover risk | If a subdomain points (CNAME) to a name that does not exist or to an inactive service, an outsider can register it and serve their own content under your address (phishing, malicious scripts). | 12 pts |
| Script integrity (SRI) | A script loaded from a foreign server without the integrity attribute runs on your page with full trust. If that server is compromised, the code on your site can be replaced. | 4 pts |
| Secrets in the page code | API keys, tokens and passwords pasted into the page code are visible to every visitor through "view source". That is ready-made access to your systems, email or payments. | 14 pts |
Brand protection 14 % of the grade, 3 checks
Whether someone can send email as your company; registered domains that look like yours.
| Check | Why it matters | Weight |
|---|---|---|
| Can your company be impersonated | Without an effective DMARC, anyone can send an email that looks like it comes "from your company" to your customers and partners. This is how fake invoice and bank account change scams work. | 10 pts |
| Lookalike domains | Fraudsters register names with a typo or a different ending to impersonate a brand and catch customers. | 6 pts |
| Similar domains with email | A similar domain with an MX record can receive email sent to it by mistake and carry on correspondence in the name of a company with a confusingly similar name. | 4 pts |
Website 18 % of the grade, 21 checks
HTTPS, certificate, security headers, cookies, CMS version.
| Check | Why it matters | Weight |
|---|---|---|
| HTTPS works | Without HTTPS, browsers show "Not secure" and form data travels in plain text. | 10 pts |
| HTTP → HTTPS redirect | If the unencrypted version works on its own, some visitors use it without knowing. | 6 pts |
| TLS certificate | An expired or mismatched certificate stops visitors at a warning screen. | 8 pts |
| Old TLS versions | TLS 1.0/1.1 are vulnerable and deprecated. Modern browsers do not use them. | 4 pts |
| HSTS | The header tells the browser to always use HTTPS - it protects against interception of the first visit. | 5 pts |
| Content-Security-Policy | It limits where the page may load scripts from - the main defense against injected code (XSS). | 4 pts |
| X-Content-Type-Options | It stops the browser from guessing file types (attacks through planted files). | 3 pts |
| Clickjacking protection | Without it, your page can be embedded in someone else's frame with invisible buttons placed over it. | 3 pts |
| Referrer-Policy | It decides which addresses from your site are sent to other sites when a visitor clicks a link. | 2 pts |
| Permissions-Policy | It turns off unused browser features (camera, microphone, location) for embedded content. | 1 pts |
| Cookie flags | A cookie without Secure can leak over http. Without HttpOnly it is readable by scripts. | 4 pts |
| Software version disclosure | A version number in the headers makes it easier to pick a ready-made exploit. | 3 pts |
| Content management system | Knowing the CMS lets us pick matching instructions. | info |
| Mixed content | Resources loaded over http on an https page are blocked or break the padlock. | 4 pts |
| Home page size | Large HTML slows down the first render, especially on a phone. | 3 pts |
| Server response time | A long time to first byte means slow hosting or no cache. | 3 pts |
| security.txt | A standard file with a contact for people who find a vulnerability. | 2 pts |
| Address with and without www. | Some people type www., some do not - both versions must lead to the site. | 2 pts |
| IPv6 | Mobile networks increasingly run on IPv6. Without an AAAA record, traffic goes through translation and connections are slower. | 1 pts |
| Sensitive files reachable from the internet | Files such as .git, .env or configuration backups contain passwords and code. | 6 pts |
| WordPress version | Old versions of WordPress and plugins are the most common way into company websites. | 6 pts |
Domain and DNS 14 % of the grade, 5 checks
Expiry date, DNSSEC, name servers, CAA.
| Check | Why it matters | Weight |
|---|---|---|
| Domain expiry date | An expired domain takes down the website and email. Getting it back can be expensive. | 8 pts |
| DNSSEC | Signed DNS answers make it impossible to substitute a fake address for your website or mail server. | 4 pts |
| Name servers | A single name server is a single point of failure. | 3 pts |
| CAA record | It limits which certificate authorities may issue a certificate for the domain. | 2 pts |
| Registry data | The registrar and the domain statuses. | info |
Privacy and GDPR 8 % of the grade, 6 checks
Privacy policy, cookies and trackers, company details.
| Check | Why it matters | Weight |
|---|---|---|
| Privacy policy | GDPR requires information about data processing when the site collects data (form, trackers). | 5 pts |
| Consent for cookies and trackers | Tracking scripts (GA, Meta Pixel) require consent before they run (ePrivacy rules, GDPR). | 5 pts |
| Company details on the site | A business is usually required to make its name, address and registration details such as VAT ID easy to find. | 4 pts |
| Notice next to the form | When you collect data through a form, you must meet the duty to inform people about how it is used. | 3 pts |
| Shop terms and conditions | An online shop must make its terms and conditions available (consumer rights law). | 2 pts |
| Third-party resources | Every foreign domain on the page is a potential transfer of visitor data. | info |
Search visibility outside the grade, 11 checks
Not part of the security score: title, description, robots, sitemap, mobile version.
| Check | Why it matters | Weight |
|---|---|---|
| Page title | The title is the first line in search results. | 4 pts |
| Meta description | The description under the title in search results. Without it, Google picks a random snippet. | 3 pts |
| H1 heading | A single main heading gives structure to the content for search engines and screen readers. | 3 pts |
| Canonical link | It points to the canonical version of the address (www/non-www, parameters). | 2 pts |
| Page language | The lang attribute helps search engines and screen readers. | 2 pts |
| Mobile version (viewport) | Without a meta viewport, the page is shrunk on a phone. Google evaluates pages on mobile. | 2 pts |
| Open Graph | It decides how a link preview looks in messengers and social media. | 2 pts |
| Structured data | JSON-LD gives search engines structured data: about a company (Organization, LocalBusiness: address, hours), a person (Person) or a product (SoftwareApplication, Product). | 2 pts |
| Home page indexing | noindex removes the page from search results. | 4 pts |
| robots.txt | The file controls crawlers. A faulty one can remove the whole site from search. | 3 pts |
| Sitemap | A sitemap speeds up indexing of new subpages. | 3 pts |
Website accessibility outside the grade, 7 checks
Not part of the security score: WCAG basics that can be checked automatically.
| Check | Why it matters | Weight |
|---|---|---|
| Image descriptions (alt) | Screen readers read alt text. Without it, an image is empty for blind users. | 4 pts |
| Document language | A screen reader picks pronunciation based on the lang attribute. | 2 pts |
| Form field labels | A field without a label is unreadable for a screen reader. A placeholder is not a label. | 3 pts |
| Heading structure | Headings h1-h6 work as a table of contents for screen readers. Skipped levels lose context. | 2 pts |
| "Skip to content" link | It lets keyboard users bypass the menu. | 1 pts |
| Page title | The title is the first thing a screen reader reads out. | 1 pts |
| Zoom on mobile | Blocking zoom makes reading impossible for people with low vision. | 2 pts |