How scoring works
Every site starts at 100.
Findings subtract points.
No complicated formulas. No arbitrary weights. You start with a perfect score and lose points for real issues — the more severe, the more it costs.
Point deductions
- AWS key found in JS bundle
- Stripe live secret key exposed
- Supabase service role key leaked
- Hardcoded password in source
- Exposed .env file (200 OK)
- Git config publicly accessible
- Source map publicly downloadable
- HSTS header missing
- Cookie missing Secure flag
- Cookie missing HttpOnly flag
- Internal staging URL in bundle
- Admin route without auth redirect
- Referrer-Policy header missing
- Permissions-Policy not set
- Stripe publishable key visible
- Firebase API key in bundle
- Cookie missing SameSite flag
- X-Content-Type-Options absent
Grade bands
No meaningful issues. Ship it.
Minor gaps. Easy wins available.
Fixable issues with real exposure.
Active risks. Fix before you scale.
Critical exposure. Fix today.
Try it
Score simulator
Dial in findings to see how the grade changes.
Clean
No meaningful issues. Ship it.
The math
start = 100
score = start − (criticals × 25) − (warnings × 10) − (suggestions × 2)
floor = max(score, 0)
grade = A ≥ 90 · B ≥ 75 · C ≥ 60 · D ≥ 40 · F < 40
Four critical findings score a zero. One critical + two warnings = 55 (D). No findings = 100 (A).
See how your site scores.
Free. No account needed. Results in 15 seconds.
Scan your site →