How scores and grades are calculated
Every number on a result page comes from a fixed rubric listed here, so it can be checked and argued with.
Findings and the health score
Each check produces Findings at one of five levels. The health score starts at 100 and subtracts 15 for every Fail and 5 for every Caution; Pass, Note and Skipped do not move it. It is floored at 0. A Check-up merges the findings of the five facets and scores them together, so a domain with one expired certificate and one missing DMARC record scores 70.
| Level | Meaning |
|---|---|
| Pass | The check succeeded and nothing needs attention. |
| Caution | Works today but is fragile, deprecated or below good practice. |
| Fail | Broken, missing or actively harmful; usually causes lost mail, downtime or a security exposure. |
| Note | A fact worth knowing that is neither good nor bad on its own. |
| Skipped | The check could not run, for example because the probe or an upstream source was unavailable. Never counted against you. |
Security-headers grade
Points out of 100 for the final HTTPS response: Strict-Transport-Security with a max-age of at least six months 25; Content-Security-Policy present 25; X-Frame-Options (deny or sameorigin) or a frame-ancestors directive 15; X-Content-Type-Options nosniff 10; a Referrer-Policy other than unsafe-url or no-referrer-when-downgrade 10; Permissions-Policy 10; Cross-Origin-Opener-Policy 5. X-Powered-By costs 5. Grades: A+ 95 and above, A 80, B 65, C 50, D 30, otherwise F.
TLS score
Points out of 100 for the certificate and handshake on port 443: certificate within its validity period 25; chain verifies to a trusted root 20; legacy protocols (TLS 1.0 and 1.1) refused 15; host name covered by the certificate 10; key strength (RSA 2048 or ECDSA P-256 and above) 10; TLS 1.3 offered 10; SHA-2 signature 5; HSTS sent 5. An expired or untrusted certificate caps the score at 40. Grades: A 90 and above, B 75, C 60, D 40, otherwise F. Cipher-suite enumeration and OCSP stapling are not part of the score yet and are stated as such.
Spoofability verdict
Protected: DMARC at quarantine (pct 100) or reject with aligned SPF or DKIM. Monitoring only: DMARC present at p=none. Spoofable: no DMARC, or SPF and DKIM both absent or broken so that nothing can align. The verdict describes what a receiver enforcing DMARC would do with a forged message from your domain.
Propagation agreement
Each resolver in the panel is asked once with a three-second timeout. Resolvers that answered are grouped by the exact record set returned; the largest group is the majority. "Consistent" means every answering resolver is in that group. The authoritative answer is shown separately and compared, but does not vote.
Watches
Uptime kinds (website, port, ping, DNS answer, mail server) need two consecutive failures, the second about a minute after the first, before an incident opens. Expiry and change kinds open on the first confirmed result. Certificate and domain expiry raise a fresh incident at 30, 14, 7 and 1 days; each supersedes the previous one without a recovery message. A recovery message is sent when a check passes after an open incident.
Indexability of result pages
A result page is offered to search engines only when the target is registered or allocated with substantive data, has been looked up by at least two distinct visitors in 90 days or sits on a curated list of well-known UK names, and has not been opted out. Everything else carries a noindex instruction and stays out of the sitemaps, to avoid thin pages about names nobody has an interest in.
Caching
Results are cached for ten minutes per target. The page says when a result was checked and whether it came from cache; "Re-run" bypasses the cache and counts against the daily allowance.