How the free scan grades your site

Every scan runs the same 8 passive checks against the domain you enter, on port 443 (standard HTTPS). Nothing is sent to your site except the requests a browser would make anyway, and nothing behind a login is ever touched.

• TLS & encryption. One TLS handshake, the same thing a browser does. A certificate browsers do not trust, or an expired certificate, fails the check; a certificate expiring within 30 days warns. A negotiated TLS 1.0 or 1.1 connection also fails, since those versions are obsolete. The negotiated version and cipher are reported; the cipher itself is not scored.
• Security headers. The homepage response headers: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options (or a CSP frame-ancestors directive), X-Content-Type-Options, Referrer-Policy, and whether plain HTTP redirects to HTTPS. A present CSP is also graded on quality — unsafe-eval, unsafe-inline, wildcard and data: sources, and missing object-src or default-src directives — and a short HSTS max-age (under 6 months) is flagged.
• DNS. Whether the domain resolves, and whether a CAA record is present (it restricts which authorities may issue certificates for the domain). A missing CAA record is a small warning, not a failure.
• Certificate history. Public certificate-transparency logs (crt.sh, first 500 rows) for subdomains that have had certificates issued. Subdomains are public by design — this is an inventory finding worth reviewing, not a vulnerability on its own.
• Sensitive files. A small set of well-known paths — including /.git/HEAD, /.env, wp-config.php.bak, /.htaccess, xmlrpc.php and /server-status — requested the way any browser could. A path only counts as exposed when its actual contents answer; a bare “page found” proves nothing.
• Cookies. Only the cookies the homepage itself sets, checked for the Secure, HttpOnly and SameSite flags. Cookies set by other pages, or by JavaScript after load, are not seen.
• Email security. SPF and DMARC records for the domain. Missing SPF or DMARC is penalised; DMARC set to monitor-only (p=none) is a smaller warning, and an SPF record ending in ?all (neutral) is a smaller warning too, while +all (authorise everyone) fails the check. DKIM is probed for common selectors and reported for information only — it is never penalised.
• Page content & libraries. The first 300 KB of the homepage markup only: mixed content (insecure resources loaded on a secure page), outdated JavaScript libraries (including jQuery, Bootstrap, AngularJS, React, Vue and WordPress versions the scan recognises), and cross-origin scripts or stylesheets served without an integrity (SRI) attribute.

Every site starts at 100. Findings subtract points, the score is floored at 0, and the grade follows the score:

• Grade A: 90–100  ·  Grade B: 75–89  ·  Grade C: 60–74  ·  Grade D: 45–59  ·  Grade F: below 45

The penalties, by check:

• TLS: fail −35, warning −15.
• Headers: itemised by what is missing — HSTS −12, CSP −10, X-Frame-Options −5, X-Content-Type-Options −5, Referrer-Policy −3, no HTTPS redirect −8 — plus CSP quality issues (subtotal capped at −10) and a short HSTS max-age (−4). The whole headers penalty is capped at −30.
• DNS: warning −2 (missing CAA); failure, or a check that could not run, −10.
• Certificate history: warning −3.
• Sensitive files: exposed file −30, lower-risk exposure −8.
• Cookies: warning −6.
• Email: up to −10 in total — missing SPF −5, missing DMARC −5, monitor-only DMARC −3, neutral SPF (?all) −2; an SPF record ending in +all fails the check at −10.
• Content: up to −10 in total — mixed content −6, outdated library −6, cross-origin resources without SRI −3.

Category scores shown on the result page present the same findings per check; the overall score above is the grade.

A check can fail to run — a timeout, or a third-party service such as the certificate log being briefly unavailable. A skipped check is not counted as a pass, but it is also not treated as proof that your site is broken:

• Skipped DNS or skipped headers each cost −10, because without them little meaningful was measured.
• Skipped sensitive-files, cookies, email or content checks each cost −5: the scan could not verify something it advertises, so the grade must not reward the gap.
• A skipped certificate-history check costs 0 — it is a lookup in someone else's log, and its absence says nothing about your site. A single skipped check like this does not wreck an otherwise honest grade.
• The grade cap: if the homepage never answers at all — headers, cookies and content all skipped — the score is capped at 89. A site whose homepage did not answer cannot earn a Grade A, no matter how clean the checks that did run look.

Any result with a skipped check is labelled partial — on the result page, on the shareable report, and on the grade badge. A partial grade is a provisional grade: re-run the scan when the unavailable service recovers, and compare the two runs before acting on it.

A Grade A means “nothing found in these 8 passive checks”. It does not mean a site cannot be hacked, and it is not a promise of security. In particular, the scan does not:

• scan ports, try logins, send payloads, or test exploits;
• look at any page other than the homepage, or at homepage content below the first 300 KB;
• check cookies set by other pages or by JavaScript, DNSSEC, or the strength of the negotiated TLS cipher;
• audit server configuration, application code, plugins or library versions beyond the ones listed above, or anything behind a login;
• verify that a fix actually works after you apply it — for that, re-run the scan, or ask about the paid Website Security Audit, which documents and prioritises the same findings with an executive summary and a free re-scan.

If you need a deeper review — code, configuration, or anything the passive scan cannot see — that is a separate, scoped engagement, quoted per scope. The scan will never quietly start doing it.