How the health score works
Every report scores the website’s health out of 100. It measures security and technical upkeep — not how good or popular the site is. It’s worked out from the checks on the report itself, so you can see exactly where each point comes from.
Five areas
Each area is scored out of 100 from the checks below. A check we couldn’t make counts for nothing either way: the area is scored on the others.
SSL & certificate30% of the score
| Certificate present, trusted and not expired | 60 |
| Days left: 30 or more (14–29: half) | 20 |
| TLS 1.3 supported | 10 |
| http:// redirects to https:// | 10 |
No certificate, an expired one or one browsers refuse scores 0 for the whole bar.
Security headers20% of the score
| Strict-Transport-Security | 25 |
| Content-Security-Policy | 25 |
| X-Content-Type-Options | 15 |
| X-Frame-Options (or CSP frame-ancestors) | 15 |
| Referrer-Policy | 10 |
| Permissions-Policy | 10 |
Full points when the header is set well, half when it’s set but weak.
Email security20% of the score
| SPF | 30 |
| DMARC with “reject” or “quarantine” (“none”: 10) | 35 |
| DKIM | 20 |
| MTA-STS | 10 |
| BIMI | 5 |
A domain with no mail servers isn’t scored on email. DKIM keys sit under names we can only guess, so not finding one doesn’t count against a site.
Performance15% of the score
| Largest Contentful Paint (good ≤ 2.5 s) | 40 |
| Interaction to Next Paint (good ≤ 200 ms) | 30 |
| Cumulative Layout Shift (good ≤ 0.1) | 30 |
Real Chrome users on phones (desktop when there’s no phone data), from Google’s Chrome UX Report. “Good” earns the points, “needs improvement” half, “poor” none. Too few visits: not scored.
Modern standards15% of the score
| DNSSEC | 20 |
| TLS 1.3 | 20 |
| IPv6 | 15 |
| CAA records | 15 |
| HTTP/3 | 15 |
| HSTS preload | 15 |
The overall score and grade
The overall score weighs the five areas as shown above. An area that can’t be scored — a domain with no email, a site with too few visits for performance data — is left out and the others are weighed up to 100%, so missing data never lowers a score.
| Grade A | 90–100 |
| Grade B | 75–89 |
| Grade C | 60–74 |
| Grade D | 40–59 |
| Grade F | below 40 |
An area scoring under 75 “needs attention”.
Safety caps
A well-configured site can still be a dangerous one, so safety limits the score:
- its servers are on a spam or malware blocklist, or the WOT community advises caution: at most 59;
- the WOT community rates it unsafe: at most 39.
What it doesn’t include
SEO, trackers and cookies, AI-crawler rules, traffic and reviews are shown on the report but don’t change the score. A site scanned before these checks existed gets its score on its next refresh.
Formula version 1. Questions or a score that looks wrong? Tell us.