How the grade is calculated
What earns points, what costs points and what it takes to get an A.
Points for security headers
Every site starts with 10 points. Each security setting your server sends to the browser adds points. These settings are called headers. With all six in place, you reach 100.
For the points, all that counts is whether a header is present. We don’t currently rate how strict its value is. It only protects you with a sensible value, though.
What gets deducted
Other findings cost points. An exposed key costs the most, because anyone can use it right away. A single master key pulls even a site with all headers down to C, two of them down to E.
| Finding | Deduction |
|---|---|
| Secret key in the HTML or JavaScript files, such as a Supabase master key or an OpenAI key | 40 points per key type |
| Value under a name such as client_secret or access_token in the homepage HTML | 25 points per type |
| No HTTPS | 20 points, and the grade is always F |
| Outdated software with known vulnerabilities | 8 points per finding, 20 at most in total |
| AI call straight from the browser, secret-named variable, parts loaded without encryption, visible error message | 10 points each |
| Database (Supabase, Firebase) reachable directly from the browser, source maps, third-party scripts without a fingerprint, references to sensitive files, Google key | 3 points each |
| Email protection, certificate or encryption, as a warning, for example no redirect from http to https | 5 points each |
| Email protection, certificate or encryption, as a notice | 2 points each |
Cookies, a visible server version and the X-Powered-By header cost nothing. They only appear as notices in the result. The score always stays between 0 and 100.
Which score earns which grade
| Grade | Score |
|---|---|
| A | 90 points or more |
| B | 75 points or more |
| C | 60 points or more |
| D | 40 points or more |
| E | 20 points or more |
| F | below 20 points or without HTTPS |
An example
Your site runs over HTTPS and sends every header except Content-Security-Policy and Permissions-Policy. That is 10 plus 20, 15, 10 and 10, so 65 points. On top of that, the DMARC record against spoofed email is missing, which is a warning. After a 5-point deduction you have 60 points, a C. A first Content-Security-Policy without rules for scripts adds 10 points, and the site stays at C. If it allows scripts only from your own domain, it adds 25 points and gives the site a B.
If the same app also has an OpenAI key in its JavaScript files, 40 points come off. The C becomes an E. Once the key is revoked and removed from the code, the next check shows the C again.
What the grade tells you
An A means the usual security headers are in place from the outside and we found nothing suspicious. It does not prove your app is secure. We can’t see login, database and access rules from the outside, see What we don’t check.
Likewise, a bad grade doesn’t mean someone has broken in. Often a few headers are missing, and on most platforms you add them in one file. The templates are in Setting headers by platform. That doesn’t work on Shopify, where these deductions stay. If the result shows an exposed key, deal with that first.
Still have questions? Email us.