How does WebAudit calculate a website's security score?

WebAudit starts every site at 100 and deducts points for missing or misconfigured security controls. Critical headers like Content-Security-Policy and HSTS each deduct 20 points if absent. Important headers (X-Frame-Options, X-Content-Type-Options) deduct 10 points each. Minor headers (Referrer-Policy, Permissions-Policy) deduct 5 points each. TLS, DNS, cookie, and cross-origin findings each carry their own deductions. The final score maps to a letter grade.

What do the letter grades A+, A, B, C, D, F mean?

Grades map directly to score ranges: A+ is 90–100, A is 80–89, B is 70–79, C is 60–69, D is 50–59, and F is anything below 50. A score of 90+ means all critical and important headers are in place with no significant TLS or DNS issues. Most production sites without a security hardening pass score between 50 and 70 (D to B range).

How much does a missing Content-Security-Policy affect the score?

A missing CSP deducts 20 points — the largest single deduction on the platform. A CSP that is present but uses unsafe-inline or unsafe-eval deducts 10 points instead, since it provides partial protection. HSTS missing is also a 20-point deduction. Addressing these two headers alone can move a site from an F or D grade up to a C or B.

Are TLS and DNS issues included in the security score?

Yes. An expired TLS certificate deducts 30 points; certificates expiring within 14 days deduct 20 points; within 30 days deduct 10 points; within 60 days deduct 5 points. Self-signed certificates deduct 20 points. DNS deductions include: no SPF record (-5), weak SPF (-3), no DMARC (-5), DMARC p=none (-3), DKIM undetected (-2), no CAA record (-2), and no DNSSEC (-3). These stack with header deductions toward the final score.

WebAudit Methodology — How We Score Website Security

Scope: web security hardening maturity
WebAudit measures whether a site has deployed standard defensive HTTP controls — headers, TLS configuration, DNS email security, and cookie hygiene. It is not a penetration test, exploit validator, or vulnerability management tool. A high score means good baseline hardening; it does not guarantee the absence of application-layer vulnerabilities such as SQL injection, broken authentication, IDOR, or business logic flaws.

Scoring overview

Every scan starts at 100 points. Points are deducted for each missing, misconfigured, or weak security control. The final score maps to a letter grade. Scores are capped at a minimum of 0.

Each finding is assigned a severity — Critical, Important, or Minor — which determines how many points are lost. Critical findings have an outsized impact on the grade; Minor findings are noted but do not sink a score on their own.

A+

90 – 100

A

80 – 89

B

70 – 79

C

60 – 69

D

50 – 59

F

0 – 49

Critical

Actively exploitable — missing control enables a known attack class (XSS, MITM, session hijacking).

Important

Weakens an existing defense — reduces protection depth or is exploitable in combination with other flaws.

Minor

Best-practice gap — recommended by security standards but not directly exploitable on its own.

🔒 HTTP Security Headers MAX −81 PTS

When a header is present but misconfigured (weak value), its severity is downgraded one level and the deduction is halved vs. the missing case.

Finding	Severity	Deduction
Content-Security-Policy missing	Critical	−20 pts
CSP present but weakened unsafe-inline, unsafe-eval, or wildcard (*) in script-src	Important	−10 pts
Strict-Transport-Security missing	Critical	−20 pts
HSTS max-age too short max-age below 6 months (15 768 000 s)	Important	−10 pts
X-Frame-Options missing	Important	−10 pts
X-Frame-Options invalid value Must be DENY or SAMEORIGIN; CSP frame-ancestors is an accepted equivalent	Minor	−5 pts
X-Content-Type-Options missing	Important	−10 pts
X-Content-Type-Options wrong value Must be exactly nosniff	Minor	−5 pts
Referrer-Policy missing	Minor	−5 pts
Referrer-Policy unsafe value Present but value not in the safe list — may expose URL parameters to third parties	Minor	−2 pts
Permissions-Policy missing	Minor	−5 pts
CORS wildcard (Access-Control-Allow-Origin: *) Allows any origin to read responses — risk to authenticated endpoints	Important	−5 pts
Server header exposes version number e.g. nginx/1.24.0 — lets attackers target known CVEs	Minor	−3 pts
X-Powered-By header present Discloses server-side technology stack	Minor	−3 pts

🛡 TLS / SSL Certificate MAX −70 PTS

Expiry, self-signed, cipher, and protocol deductions are independent and cumulative (worst case: expired −30 + self-signed −20 + deprecated protocol −10 + weak cipher −10 = −70). Connection-error paths (SSLError, unreachable) are mutually exclusive with each other and with the certificate/cipher checks — only one applies per scan.

Finding	Severity	Deduction
Certificate expired	Critical	−30 pts
Expires within 14 days	Critical	−20 pts
Expires within 30 days	Important	−10 pts
Expires within 60 days	Minor	−5 pts
Self-signed certificate	Critical	−20 pts
Deprecated TLS protocol in use SSLv2, SSLv3, TLSv1, TLSv1.1 — stacks independently with cipher and expiry deductions	Important	−10 pts
Weak cipher suite in use RC4, DES, 3DES, NULL, EXPORT, ANON — stacks independently with protocol and expiry deductions	Important	−10 pts
TLS handshake or certificate verification failed SSLError or cert verification error — no other TLS deductions applied in this path	Critical	−15 pts
HTTPS not reachable on port 443 Connection refused, timed out, or unreachable — no other TLS deductions applied in this path	Critical	−20 pts

📡 DNS Email Security & Certificate Security MAX −15 PTS

Domain normalization: DNS records are always queried at the apex domain. If you scan www.example.com, WebAudit resolves DNS for example.com — SPF, DMARC, DKIM, CAA, and DNSSEC records live at the apex, not on the www subdomain. Subdomains are stripped automatically so the scan always reflects your domain's actual email security posture.

Finding	Severity	Deduction
SPF record missing	Important	−3 pts
SPF record invalid or multiple records RFC 7208 permits exactly one SPF TXT record per domain	Important	−3 pts
SPF weak policy +all or ?all allow any sender to pass SPF	Minor	−3 pts
DMARC record missing	Important	−5 pts
DMARC policy set to none p=none monitors but takes no enforcement action	Minor	−3 pts
DMARC policy unknown or invalid Any p= value other than none / quarantine / reject — treated the same as a missing DMARC record	Important	−5 pts
DKIM not detected Checked against 12 common selectors; custom selectors may not be found	Minor	−2 pts
CAA records missing No Certification Authority Authorization records restrict certificate issuance	Minor	−2 pts
DNSSEC not enabled Checked via DS records at the domain registrar	Minor	−3 pts

🍪 Cookie Security PER COOKIE · UNCAPPED

Deductions apply per insecure cookie. A page with many insecure cookies can accumulate significant point loss. SameSite issues are reported but do not currently affect the score.

Finding	Severity	Deduction
Secure flag missing	Important	−5 pts
HttpOnly flag missing	Important	−5 pts
SameSite=None or SameSite missing Reported as a finding; no point deduction applied in current scoring	Minor	0 pts

🔗 Cross-Origin Isolation MAX −6 PTS

These are modern, emerging headers not yet universally deployed. All three are scored as Minor — their absence is noted but does not materially impact the overall grade.

Finding	Severity	Deduction
Cross-Origin-Opener-Policy missing Weak value (unsafe-none): −1 pt	Minor	−2 pts
Cross-Origin-Embedder-Policy missing Weak value (unsafe-none): −1 pt	Minor	−2 pts
Cross-Origin-Resource-Policy missing Weak value (cross-origin): −1 pt	Minor	−2 pts

📄 Page Analysis MAX −6 PTS

Checks performed by parsing the HTML body of the response. Each finding is binary — deducted once regardless of how many instances exist.

Finding	Severity	Deduction
Mixed content detected HTTP resources loaded on an HTTPS page (scripts, images, iframes)	Important	−2 pts
Subresource Integrity (SRI) missing External scripts or stylesheets loaded without an integrity= attribute	Minor	−2 pts
Base tag present <base href> can be hijacked to redirect relative links to a malicious domain	Minor	−2 pts

Standards & limitations

Scores are based on industry standards including the OWASP Secure Headers Project and the Mozilla Web Security Guidelines. WebAudit does not replace a full manual penetration test. A high score indicates good baseline hygiene, not the absence of vulnerabilities — application-layer issues such as SQL injection, broken authentication, and business logic flaws are outside the scope of this automated tool.

How we score.

Scoring overview

Standards & limitations