Every grade traces to a measured fact, mapped to a published standard.
The Website Report Card is not an opinion of your site. It reads objective, independently‑verifiable signals — your site's actual HTTP response headers and page markup — and scores them against the same criteria used by OWASP, Mozilla, Google, the W3C, and the security & compliance frameworks below.
How grading works
Two stages. The first is fully deterministic — the same measurement anyone can reproduce. The second explains and prioritizes what the first found.
Collect objective signals
Your URL is fetched server‑side and its actual HTTP response headers and rendered HTML are parsed. We record facts: which security headers are present, whether HTTPS is enforced, which structured‑data types exist, heading and alt‑text coverage, and so on. No judgment yet — just what is and isn't there.
Score against rubrics
Those measured facts are scored A–F per category and turned into prioritized, plain‑English fixes. Because the inputs are objective, every grade traces back to a signal you can check yourself — it is not a subjective impression of the site.
What is actually measured
The exact signals the tool collects, by category. This is the whole list — nothing is inferred beyond it.
Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, X-XSS-Protection, Cross-Origin-Opener/Embedder/Resource-Policy, and Permissions-Policy — plus Cache-Control, server‑version disclosure, and cookie‑consent / privacy‑policy presence.H1/H2 hierarchy, image alt coverage, and internal‑link count.FAQPage/HowTo schema, and author / E‑E‑A‑T signals for AI‑engine citation.Mapped to recognized standards
Each check answers to a published authority. These are the primary references a technical reviewer would expect.
| What we check | Recognized standard / authority |
|---|---|
| Security response headers | OWASP Secure Headers Project; Mozilla Web Security Guidelines / HTTP Observatory; MDN Web Docs. Missing headers = OWASP Top 10 A05:2021 (Security Misconfiguration). |
| HTTPS / TLS in transit | Google (HTTPS ranking signal, 2014); NIST SP 800-52 Rev 2 (TLS guidance); browser "Not Secure" enforcement. |
| Structured data (schema) | schema.org vocabulary; Google structured-data / rich-results guidelines. |
| Title / meta / canonical / robots | Google Search Essentials; W3C HTML living standard. |
| Headings & image alt text | W3C WCAG 2.2 (accessibility); Google Search Essentials. |
| Render-blocking / caching / weight | Google Core Web Vitals & Lighthouse; web.dev performance guidance. |
| Open Graph / social markup | Open Graph protocol (ogp.me). |
Security & compliance control mapping
The security signals above are the exact web‑facing controls named in the major frameworks. The transport‑encryption row is the clearest line from "a header is missing" to "a named control is unmet."
| Signal | Framework control(s) it evidences |
|---|---|
| HTTPS / TLS in transit |
NIST CSF 2.0 PR.DS-02 · NIST 800-53 SC-8 · PCI-DSS v4.0 Req 4 · HIPAA §164.312(e)(1) · CIS v8 3.10 · NIST 800-171 / CMMC 3.13.8, 3.13.11 |
| Security headers CSP · HSTS · XFO · … |
OWASP ASVS V14 · NIST 800-53 SC-7, SC-18 · PCI-DSS v4.0 Req 6 · HIPAA §164.312(c)(1) · CIS v8 Control 16 |
| Server disclosure & config | NIST 800-53 CM-6 · PCI-DSS v4.0 Req 2 |
Framework references indicate the control families these web‑facing signals support; they are not a substitute for a full audit. A failing header is corroborating evidence of an unmet control, not a formal compliance finding.
Don't take our word for it — verify it
The security measurements are objective and reproducible.
Anyone can confirm the same facts the grade is built on:
✓ Inspect the response headers directly: curl -I https://yourdomain.com
✓ Run the same site through Mozilla HTTP Observatory or securityheaders.com and compare.
✓ Open your browser's DevTools → Network → the document request → Headers.
If a header is missing in those tools, it is missing in ours — and vice‑versa. That reproducibility is the point.
Scope & boundaries
The Report Card is a fast, free posture indicator — accurate about what it measures, and honest about what it does not.
SPF / DKIM / DMARC) and DNS‑level checks are covered by Securafy's separate Domain Scanner. The grade is a conversation‑starter, not a formal audit or penetration test.
References
Run your site through the Report Card
Get a full 100-point grade across SEO, AEO, Security, Performance, and Best Practices — free, no email required. Then download a written report you can share with your team.