How the auditor grades
A grade is only useful if you can see how it was made. Every scan starts at 100 points. Each problem found takes points off, and the total is limited to between 0 and 100. The tables below list every check and its cost.
The weights are our judgement of how much each issue matters to an ordinary website, not an official standard. They may change as practice changes, and changes are noted on the status page.
Connection and certificate (TLS)
| Check | What triggers it | Points |
|---|---|---|
| No HTTPS connection at all | The site does not answer on port 443, or the handshake fails. The scan stops here. | Score 0 ยท F |
| Certificate not trusted | Expired, self-signed, wrong hostname or untrusted issuer. | -40 |
| Old TLS version | Negotiated TLS 1.1 or lower (also SSLv3 and older). | -30 |
| Weak cipher | Negotiated cipher uses RC4, 3DES, MD5, EXPORT, NULL or anonymous key exchange, or fewer than 128 bits. | -15 |
| TLS 1.2 instead of 1.3 | Server negotiated TLS 1.2 although the scanner offered TLS 1.3. | -3 |
HTTP security headers (on the page the scan lands on)
| Check | What triggers it | Points |
|---|---|---|
| Strict-Transport-Security | Missing: 15. No max-age: 10. max-age under one year: 5. | -5 to 15 |
| Content-Security-Policy | Missing: 15. Wildcard default-src: 10. unsafe-inline without a nonce or hash: 5. | -5 to 15 |
| X-Frame-Options | Missing: 10. Value other than DENY or SAMEORIGIN: 5. | -5 to 10 |
| X-Content-Type-Options | Missing, or not set to nosniff: 10. | -10 |
| Referrer-Policy | Missing: 5. unsafe-url or no-referrer-when-downgrade: 3. | -3 to 5 |
| Permissions-Policy | Missing. | -3 |
| Page could not be fetched | TLS worked but the page request failed, so headers could not be checked. | -20 |
Page behaviour
| Check | What triggers it | Points |
|---|---|---|
| HTTP to HTTPS redirect | Port 80 answers but does not redirect to HTTPS. If port 80 is closed there is no penalty. | -5 |
| Cookies | Any cookie set by the page is missing Secure or HttpOnly. Counted once. | -5 |
| Mixed content | The HTTPS page loads scripts, images, frames, media or stylesheets over plain HTTP. | -5 |
DNS and email
| Check | What triggers it | Points |
|---|---|---|
| CAA record | No CAA record limiting which certificate authorities may issue for the domain. | -2 |
| DNSSEC | No DNSKEY record found for the zone. | -2 |
| DMARC | Missing: 5. Policy is p=none (monitoring only): 2. | -2 to 5 |
| SPF | No SPF record. | -3 |
Shown but not scored
- Certificate Transparency: whether the certificate has embedded timestamps. A certificate can prove this in other ways, so it is information only.
- security.txt: whether the site publishes a security contact file.
- SameSite on cookies is displayed but not scored.
Grade bands
A+
97-100
A
93-96
A-
90-92
B+
87-89
B
83-86
B-
80-82
C+
77-79
C
73-76
C-
70-72
D+
67-69
D
63-66
D-
60-62
F
below 60
What a scan does
- One TLS connection to port 443, and one request to port 80 without following redirects.
- One request for the home page, following up to five redirects, plus one request for /.well-known/security.txt.
- A few DNS lookups for CAA, DNSSEC, SPF and DMARC.
- Requests identify themselves as LSB-OS-Security-Auditor, so site owners can recognise them in their own logs.
- Only publicly reachable addresses are scanned. Private, loopback and internal addresses are refused, including after redirects.
- Short time limits apply, and each visitor is rate limited. Results are not stored.
What it cannot tell you
- It tests the public face of one home page from one place on the internet. Logged-in areas, other pages, other servers and your internal systems are not covered.
- A high grade is not a guarantee of security, and a low grade does not mean you have been breached.
- DNSSEC is checked by looking for signing keys, not by validating the whole chain. DMARC, SPF and CAA are looked up on the domain and, for subdomains, its parent using a simple "last two labels" rule that can misjudge domains like .co.uk. DKIM is not checked, because it needs a selector name we cannot know.
- Cookie checks only see cookies set on that first request.
Information only, not legal advice.