What the security grade means

When you check a website or GitHub repo here, you get a grade from A+ to F and a score out of 100. Here is what goes into it.

For websites we look at: - HTTPS and certificates: does the site insist on a secure connection, and is its certificate valid? - Security headers: settings the site sends to your browser that block common attacks, such as HSTS and a content security policy. - Cookies: are they marked so they only travel over HTTPS and cannot be read by scripts? - Software versions the server gives away: version numbers tell attackers exactly what to try. This is how we flag servers that may be exposed to PHP2Shell. - Email spoofing protection: SPF and DMARC records, which stop others from sending email that looks like it came from the domain. - Third-party scripts: code loaded from other companies' servers, which can change without the site owner knowing.

For GitHub repos we look at: - Known-vulnerable dependencies, checked against the OSV vulnerability database. - Secrets committed to the code, such as API keys and tokens. We only ever show a masked hint, never the secret itself. - Risky code patterns that often lead to security bugs.

The checks are passive. We only look at what an ordinary browser visit (or the public repo) shows. We never try to break in, log in or attack anything.

The scale: A+ means very little to fix. A and B are in good shape with a few gaps. C and D have problems worth fixing soon. F means serious problems that need attention now. Serious findings weigh far more than minor ones.

A good grade is not a guarantee. We cannot see inside the server, its passwords, its plugins' code or how it is run day to day. A site with an A can still be hacked, and a lower grade does not mean a site is unsafe to read. Use the grade as a starting point and the report's fixes as a to-do list.