How is a website security score calculated?

Every site starts at 100. Each confirmed finding deducts points by severity, critical 30, high 15, medium 7, low 3, with repeats of the same issue counting less each time and a cap per category so one noisy area cannot sink the whole score.

What is a good website security score?

90 or above (grade A) means no critical or high findings. Anything below 55 usually means a high or critical issue that should be fixed the same day.

Can I check my website security score for free?

Yes. The Lite scan is free, with no signup, and returns a score with the findings behind it.

Website security score

Check your website security online and get a single number you can act on, plus the findings behind it, and a fix prompt for each one.

Get your score now

Free Lite scan, no signup. Paste your URL and you'll have a score in seconds.

Run a free scan Check headers only

How the score is calculated

Every site starts at 100. Each confirmed finding deducts points by severity: critical 30, high 15, medium 7, low 3. Informational notes deduct nothing. Two rules keep the number honest. Repeats of the same issue count less each time, so a header missing on ten pages is one problem, not ten. And each category, headers, secrets, transport, data access, dependencies, has a cap, so one noisy area can't drag an otherwise healthy site to zero. Findings you ignore for your own account stop affecting the score on future scans of the same URL.

What each grade means

A90–100

No critical or high findings. Headers, cookies and transport are configured.

Fastest win: Re-scan after every deploy and keep dependencies current.

B75–89

Solid basics with a few medium findings, usually a missing header or a permissive policy.

Fastest win: Clear the mediums; most are a one-line config change.

C55–74

Several gaps that a scanner or an opportunist would find quickly.

Fastest win: Start with any exposed file or key, then set the missing headers.

D35–54

At least one high-severity issue, often alongside no headers at all.

Fastest win: Rotate anything exposed today, then fix transport and headers.

F0–34

A critical finding, a live secret, an open database rule, or an exposed config file.

Fastest win: Treat it as an incident: rotate credentials, lock the data down, re-scan.

The fixes that move the number most

Rotate anything exposed. A live secret in your bundle is the single biggest deduction, and the only one that is already being exploited by the time you find it. See exposed API keys in frontend code.
Lock down database access. Row level security off, or a policy that passes for everyone, means your tables are public. See row level security mistakes.
Set the seven headers. Minutes of work, no visible change to your app, and it clears a whole category. Use the headers checker.
Fix cookie flags and HTTPS. Secure, HttpOnly, SameSite, and HSTS on every response.
Remove files that shouldn't be public. .env, .git, sourcemaps and backup config are the classic accidental leaks.

Common questions

Is the score comparable between scans?: Yes, for the same URL and scan type. A Deep Scan runs more probes, so it can find issues a Standard scan didn't, a lower Deep score isn't a regression, it's a fuller picture.
What is a good score?: 90 or above. Below 55 usually means something high or critical that deserves attention the same day.
Does a perfect score mean I'm safe?: It means nothing we can see from outside is wrong. Logic flaws in your own code, who can edit what, who can see whose data, still need thinking about. Our case study walks through a real-shaped example.