Security Rating Grade A–F: How It Is Formed
The security rating is a letter result of the scan in the Security Shield subservice. The site starts with 100 points, and each identified issue deducts points depending on severity, with the final number converted into a letter. The scale ranges from A+ (almost clean) to F (many serious issues).
How Findings Translate to a Letter
The weight of a finding depends on its severity level. This, in turn, is determined by the commonly accepted CVSS scale: a score of 9 is critical, 7 is high, 4 is medium, and below that is low. There is also an 'info' level — it is informational and does not affect the score.
| Level | Deductions for the First Finding |
|---|---|
| Critical | 35 points |
| High | 18 points |
| Medium | 8 points |
| Low | 3 points |
| Info | 0 |
Each subsequent finding of the same level deducts less than the previous one — the weight diminishes. This is done for the sake of fairness: twenty minor remarks should not nullify a site that has no serious vulnerabilities. The opposite is also true: a single critical finding immediately brings the score down to around C, and no amount of green checkmarks can compensate for that.
Scale
| Points | Rating | How to Read |
|---|---|---|
| 95 and above | A+ | No significant problems found |
| 85–94 | A | Minor remarks |
| 75–84 | B | There is room for improvement, no urgency |
| 65–74 | C | Usually indicates one serious finding |
| 50–64 | D | Several significant issues |
| 35–49 | E | Requires attention soon |
| below 35 | F | Critical issues, address immediately |
What Exactly Is Checked
In any mode, including the fast free scan: security headers and cookie flags, TLS and certificate, connected libraries, search for malicious code, CMS versions and known vulnerabilities, key leaks, DNS and mail records, domain blacklisting. In paid modes, additional checks include: searching for open files and service paths, CORS policy, injection surface and SSRF, signs of cloaking and SEO spam, WordPress protection, and in the most comprehensive mode — subdomain enumeration and the risk of hijacking. An optional server agent works separately: it examines files from the inside and looks for backdoors, changes in the CMS core, and unauthorized administrators.
The Letter and the “Traffic Light” Are Not the Same
In addition to the score, the report includes a verdict: “Clean”, “There Are Remarks”, “There Are Vulnerabilities”, “Serious Risks”, “Infected”. It is calculated not based on points, but on the composition of findings — whether there are signs of active infection among them. Therefore, the verdict and the letter can differ: a single finding of “domain blacklisted” will leave a fairly decent score, but the verdict will be “Infected”. Read the verdict first, then the letter.
Where the Rating Is Visible
- Project Card in Shield. A ring with the letter and score, above it — the verdict and the number of checks passed.
- Site Lists and Scan History. The score of each scan, showing the dynamics.
- Printed Report and Public Badge. The badge can be embedded on the site.
- Email Notification of Scan Completion. The score is right in the email subject.
- Drop Notification. Comes when there is a significant drop in score between scans — configurable in notifications.
How to Improve It
The order of work is simple: first, everything related to infection, then critical findings, then high ones. For some issues, the service generates a ready configuration fragment or a list of DNS records — but they must be applied manually by the site administrator. The score is recalculated only with a new scan: until it is launched, the letter remains the same, no matter how many fixes you have made. More about the service — in the article about Shield.
Common Misconceptions
- “A means the site won’t be hacked.” No. The score reflects what is visible from the outside at the time of the scan and says nothing about vulnerabilities in your code.
- “Downloaded auto-fix — the score increased.” Until the fragment is applied on the server and a new scan is done, nothing will change.
- “Letters are comparable between sites.” Caution: free and paid scans have different sets of checks. Compare the site’s score primarily with its previous score.
- “A technical audit will show the same thing.” No, these are different things: SEO Audit looks at technical SEO, Shield looks at security.