How SiteGuardia scores a website

Why this page exists

A score nobody can reconstruct is a score nobody should trust. The method below is the whole method. It is deterministic: the same findings always produce the same number.

The engine is versioned, and every report states the version it was scored under. When the method changes, the version changes, and old reports are not silently rescored.

Current engine: 1.0.0.

The weights

These weights are a SiteGuardia product decision. They are not an industry standard and we do not present them as one. HTTPS and TLS carries the most because a failure there affects every visitor on every page. DNS hygiene carries the least because a gap there is usually hardening rather than exposure.

How a category is scored

Each category starts at 100. Every failed check deducts, and the deduction is the base penalty for its severity, scaled by how confident we are:

So a high-severity finding we are only medium-confident about deducts 15, not 25. This is what keeps a fingerprint guess from scoring like a confirmed weakness.

Total deductions within one category are capped at 85. Without the cap, five medium header findings would zero a category that is otherwise well configured, and the score would stop telling imperfect apart from abandoned.

The rules that change the answer

An unknown never penalises like a failure. If a check could not determine an answer, it deducts nothing. Reporting uncertainty as failure is how a scanner becomes a fear machine.

A module that did not finish is excluded, not zeroed. If the passive web assessment times out, its categories are removed from the weighted average and the remaining weights are renormalised. The report says it is partial. It never reports an unfinished check as a clean one.

A confirmed critical caps the overall score at 59. A confirmed high caps it at 79. Without a cap, a site with a serious confirmed problem could still show in the nineties on the strength of everything else, which is a number that would mislead.

A cap requires confirmation. An inferred or version-based finding never caps a score. A single fingerprint guess must not be able to halve the result of a well-run site.

The overall score

The weighted average of the category scores, using only the applicable categories, rounded half up to a whole number, then clamped to the range 0 to 100, then capped if a cap applies.

The bands

The bands describe a public posture, not safety. We do not use phrases like "100% secure", because no automated check can support that claim.

Severity and confidence are separate

Severity is how much it would matter. Confidence is how sure we are that it is true. They are shown together on every finding, because "high severity, medium confidence" is the honest reading, and collapsing the two is how a scanner turns an observation into an accusation.

Every finding also records how it was arrived at: a confirmed observation, an inference, a version-based hypothesis, or information. We never promote a version string to a confirmed vulnerability.

What a complete category does not mean

A category that shows five of five areas evaluated, or scores 100, has passed every check this product runs in it. That is not the same as having no problem in that area, and the difference is not a caveat: it is the shape of the thing.

Each category is a finite list of checks somebody chose, made from outside, without credentials, in a few minutes. There are properties of any of these areas that cannot be observed that way at all, and a check that does not exist cannot fail.

DKIM is the example worth naming. DKIM proves a message was signed by the domain it claims to come from. Verifying it requires a signed message, and a scan has none: it can only look for a DKIM record at the selector names that are commonly used, and a domain that signs correctly with an uncommon selector looks identical to one that does not sign at all. So email domain security can score well with DKIM effectively unexamined. When that happens the report says the check was not evaluable rather than counting it as passed, but the category score is still a score over the checks that did run.

The same applies elsewhere in smaller ways. A TLS category that passes has a configuration we could negotiate with; it says nothing about a certificate's private key. A headers category that passes has the headers we read on the pages we read.

What the score is not

It is not a measure of whether your site can be broken into. It is a reading of the public signals we check, taken at one moment. A perfect score means every public signal we check passed. It does not mean there is nothing to find.