Methodology · the full rubric
40 ways to lose a point.
Forty-one findings, and we charge for forty — SameSite is reported free. That's the whole rubric: every check the scanner runs, the exact points it costs and the threshold that trips it. No weighting we won't show you, no black box. Run the same URL tomorrow and the arithmetic comes out identical.
Subtractive, and capped at zero
Every scan starts at 100 points. Points come off for each missing, misconfigured or weak control, and the total is floored at 0 — a site cannot go negative no matter how much it stacks up.
Each finding carries a severity, and severity is the whole of the weighting. There is no secondary multiplier, no per-industry curve and no adjustment for how popular the domain is.
Actively exploitable — the missing control enables a known attack class outright: XSS, machine-in-the-middle, session hijacking.
Weakens an existing defence — reduces protection depth, or becomes exploitable in combination with another flaw.
Best-practice gap — recommended by the standards bodies, but not directly exploitable on its own.
One scale, no curve
The letter is a direct read-off from the score — the same six bands for every site, every time. Note the shape of it: F occupies half the ruler. Fifty points of failure share one letter, while the top forty are split five ways, because the distance between a hardened site and a very good one is the part worth resolving.
Drag the ruler — or use the arrow keys — to read any score
Every deduction, priced
All forty-one findings the scanner can raise, with the exact points each one costs — forty of them priced, one (SameSite) reported at zero. Bar length is the size of the hit; its colour is the severity. Caps shown per module are worst-case totals — most are mutually exclusive in practice, so a real scan never hits all of them at once.
HTTP Security Headers
MAX −81 PTSWhen a header is present but misconfigured — a weak value rather than an absent one — its severity drops one level and the deduction is roughly halved against the missing case.
frame-ancestors directive is accepted as equivalent
nosniff
nginx/1.24.0 — hands attackers a CVE list to work from
TLS / SSL Certificate
MAX −70 PTSExpiry, self-signed, cipher and protocol deductions are independent and cumulative — worst case, expired −30 plus self-signed −20 plus a deprecated protocol −10 plus a weak cipher −10 comes to −70. The two connection-failure paths are mutually exclusive with each other and with every certificate check: only one of them can apply per scan.
DNS Email & Certificate Security
MAX −15 PTSDomain normalisation: DNS records are always queried at the apex domain. Scan www.example.com and SecureScanr resolves example.com — SPF, DMARC, DKIM, CAA and DNSSEC records live at the apex, never on the www subdomain. Subdomains are stripped automatically so the result reflects the domain's actual email posture.
+all or ?all let any sender pass SPF
p=none monitors but takes no enforcement action
p= value outside none / quarantine / reject is treated as a missing record
Cookie Security
PER COOKIE · UNCAPPEDThese deductions apply per insecure cookie, which is why the module carries no cap — a page setting a dozen loose cookies can lose a great deal on this one module alone. SameSite is reported as a finding but does not currently affect the score.
Cross-Origin Isolation
MAX −6 PTSModern headers, not yet universally deployed. All three score as Minor — their absence is recorded but will not sink a grade on its own. A header that is present with a weak value costs half: −1 instead of −2.
unsafe-none): −1 pt
unsafe-none): −1 pt
cross-origin): −1 pt
Page Integrity
MAX −6 PTSPerformed by parsing the HTML body of the response. Each finding is binary — deducted once, however many instances the page contains.
integrity= attribute
No finding matches .
Nothing here is a judgement call you can't reproduce by hand.
What the grade measures
Whether a site has deployed the standard defensive controls that are observable from outside it: HTTP security headers, TLS configuration, DNS email security, cookie hygiene and page integrity. Thresholds follow the OWASP Secure Headers Project and the Mozilla Web Security Guidelines.
What it does not
This is not a penetration test, an exploit validator or a vulnerability manager. A high score means good baseline hardening — it says nothing about application-layer flaws such as SQL injection, broken authentication, IDOR or business logic errors, none of which are visible to an automated external scan.