What does my score mean?

A single percentage is convenient, but only useful once you understand how it comes about. Here's the honest explanation — no black box.

Two blocks: website and mail

We score the website configuration (DNS, TLS, HTTP/security headers, routing) and the mail configuration (SPF, DKIM, DMARC, transport encryption, blacklists) separately. That way you see at a glance where it hurts — a top website can still have weak mail protection.

How points arise

Each category starts at 100. A failed check deducts points — graded by severity (info → no deduction, low, medium, high, critical). The overall score is a weighted average of the categories. Importantly, every check has a requirement level (required / recommended / optional) — a missing optional bonus is no big deal.

"Not applicable" is not a fault

Some checks simply aren't relevant to your setup — for example Subresource Integrity when a page loads no external scripts at all. Such checks show up as "not applicable" and deduct no points. That's honest and correct, not a blemish.

Why we don't sugar-coat

We name problems plainly, but without scaremongering — and we don't penalise legitimate configurations just because they're uncommon. Every check is documented under "All checks in detail": what is checked, why, and how to improve it. The score is a tool, not a verdict.