Grading methodology
Explainable, stable, automatable — the contract behind every grade.
Current contract: gradingVersion 3.1
Principles
- Every check that produces a grade includes
sslGrade.gradingVersion. Pin it if you gate a build on the letter grade; a bump means re-baseline, not necessarily a regression in your site. - When we cannot see the site (CDN / bot challenge), we do not invent headers or a grade — see bot protection.
- Response time appears in the report for convenience; it does not affect the grade.
Eight factors (100 points)
Achievable scores are multiples of 5. In practice: A+ = 100, A = 90 or 95, A- = 85, B+ = 80.
| Factor | Points | What we check |
|---|---|---|
| HTTPS Connection | 25 | A TLS handshake to https:// completes and returns a usable response. |
| HTTP to HTTPS Redirect | 20 | A plain http:// request is redirected to HTTPS (prefer 301). |
| Valid SSL Certificate | 20 | Certificate is within its validity window and covers the checked hostname. |
| Certificate Not Expiring Soon | 10 | More than 14 days until expiry (aligned with typical Let’s Encrypt renew-at-~30 behaviour). |
| Modern TLS (no 1.0/1.1) | 10 | Server does not accept TLS 1.0 or 1.1. When TLS probe data is unavailable we give the benefit of the doubt. |
| Short Redirect Chain | 5 | HTTPS works and the redirect chain has at most three hops. |
| HSTS Enabled | 5 | Strict-Transport-Security is present with a positive max-age (max-age=0 counts as weak / not enabled). |
| Security Headers | 5 | At least four of the six headers pass, and Content-Security-Policy is present. Only correct values count. |
Grade thresholds
A+ also requires HSTS preload (on the Chromium list, pending, or eligible), Content-Security-Policy, and TLS 1.3. An invalid certificate hard-caps the grade at F. A missing redirect hard-caps at C only when port 80 is actually reachable and serving without redirect — see below.
Port 80 closed
If TCP/HTTP on port 80 does not answer (httpPort80Reachable: false), we do not treat “no redirect” as a critical misconfiguration: there is no HTTP listener to redirect from, and browsers often auto-upgrade. You still lose the 20 redirect points (a perfect site tops out around B+). Open port 80 with a 301 to HTTPS to recover them. Older stored reports without the field keep the legacy hard-cap at C.
Weak vs missing headers
Missing
The header was not sent at all. Counts as not passed toward the security-headers score.
Weak
The header was sent, but the value does not deliver the intended protection (API: present: false, weakValue: true). Examples: HSTS with max-age=0; Referrer-Policy no-referrer-when-downgrade or unsafe-url; X-Content-Type-Options with a value other than nosniff.
Accuracy pledge
When we cannot see the site, we do not invent a grade. A CDN or WAF challenge is not “all headers missing” and not an F — it is botProtectionBlocked: true with the grade and header breakdown withheld. We would rather return an honest unknown than a confident lie. CI policy mode (minGrade / headersMinGrade) fails closed on that signal (HTTP 422) so pipelines do not treat a block page as a green check.
Bot protection (details)
When a CDN or WAF serves a challenge page instead of your real response, we set botProtectionBlocked: true and withhold the grade and header breakdown. Fix: allowlist our checker egress, or rely on monitoring from a network that can reach the origin.
Certificate Transparency
CT is part of continuous monitoring (paid plans): we alert on unexpected certificates for your domains. A one-shot public check does not fold CT into the letter grade.
What we do not measure
- Full cipher-suite enumeration or SSL Labs–style handshake matrix
- Application vulnerabilities, SCA, or malware scanning
- Uptime / availability SLAs (we are not an uptime monitor)
- Bypassing CAPTCHA, Turnstile, or other bot challenges
- Client-side-only headers injected by a browser extension
Grading changelog
Semantic changes bump gradingVersion. Consumers that pin the version should treat a change as a signal to re-baseline.
- Closed or firewalled port 80 no longer hard-caps a missing HTTP→HTTPS redirect at C — there is no listener to redirect; the 20-point factor still applies.
- Referrer-Policy is evaluated per the spec (last recognised token). no-referrer-when-downgrade is weak: it leaks the full URL cross-origin, more than the modern browser default.
- API responses publish sslGrade.gradingVersion so consumers can pin the contract.
- Eight factors on a 100-point scale. Modern TLS (no 1.0/1.1) scored as +10 instead of a hard grade cap.
- Response time removed from the grade (still shown in the report).
- A+ requires score ≥97 plus HSTS preload (on the list or eligible), Content-Security-Policy, and TLS 1.3.
- Invalid certificate hard-caps at F. Missing redirect with port 80 serving content hard-caps at C.
Machine-readable checks: Public API. Short answers: FAQ.
Check your domain →