How Is Website Security Score Calculated?
A short answer to two common questions: what counts as a good website security score, and how the number is actually calculated.
Last updated August 9, 2026.
The short answer
A website security score is a 0–100 number calculated by starting at 100 and subtracting points for each issue found, based on how severe it is: Critical issues cost 20 points, High 15, Medium 8, Low 3, and Info issues cost nothing. Deductions are grouped into categories — SSL/TLS, HTTP headers, redirects, cookies, DNS, and technology detection — and each category has a cap on how much it can subtract, so no single category can sink the whole score by itself. The final number maps to a letter grade: 90–100 is A, 80–89 is B, 70–79 is C, 60–69 is D, and below 60 is F.
What counts as a good score?
As a rule of thumb, 80+ (B or A) means the scan found no major unresolved issues among the categories it checks. Below 70 (D or F) usually points to a Medium-or-higher severity finding, or several findings clustered in one category — worth reviewing regardless of what caused the drop.
Why the score sometimes doesn't move
Because each category's deduction is capped, a category with several findings can already be "maxed out" — fixing one issue in it won't change the score until the category's raw deduction drops back under its cap. This is intentional: it stops one check with many sub-findings (headers, for example) from dominating the whole score.
What the score is not
It's not AI-generated or predictive — it's a fixed, deterministic calculation over what the scan actually observed. It's also not a penetration test: it checks externally visible configuration, not application logic, and doesn't attempt exploitation. A check that couldn't run for a given site is reported as "Not measured," never silently scored as a pass.
FAQ
How is website security score calculated?
It starts at 100 and subtracts points for each finding based on severity — Critical (20), High (15), Medium (8), Low (3), Info (0) — grouped by category (SSL/TLS, Headers, Redirects, Cookies, DNS, Technology). Each category has a maximum deduction it can apply, so the total subtracted from 100 is capped per category before it's summed.
What is a good website security score?
80 or higher (grade B or A) typically means no major unresolved issues in the checked categories. Below 70 (D or F) usually signals at least one higher-severity finding or several findings in one category.
What grade is a 75 website security score?
A score of 75 falls in the 70–79 range, which maps to a C grade.
Why didn't my score change after I fixed an issue?
Because deductions are capped per category. If a category's raw deduction already exceeds its cap, the score reflects the cap — fixing one issue in that category may not bring the raw total below the cap yet, so the visible score stays the same until enough issues are resolved.
See your score
Run a free scan to see your own score, grade, and every finding behind it.
Run a free scan