Understanding SiteSecura Security Scores & Severity Grades

The SiteSecura Scoring Philosophy#

Security metrics should be transparent, actionable, and mathematically deterministic. Many vulnerability scanners generate arbitrary "risk percentages" that leave systems administrators confused about how a specific score was derived.

SiteSecura uses a deterministic deduction-based scoring formula. Every scanned website begins with a perfect baseline score of 100 points. As our scanning modules inspect your target, specific penalty deductions are subtracted based on verified security findings and their assigned severity levels.

---

Severity Weights and Deduction Penalty Matrix#

SiteSecura categorizes findings into five standardized severity levels:

Scoring Floor and Multi-Finding Cap#

• Score Floor: The minimum possible score is 0. A score cannot be negative.
• Independent Accumulation: Each distinct security vulnerability applies its full deduction penalty. For example, a website with an expired SSL certificate (-30) and missing HSTS (-15) receives an initial deduction of 45 points, yielding a score of 55.

---

Risk Tiers and Letter Grades#

Based on the final computed numeric score, SiteSecura assigns a corresponding letter grade and executive risk classification:

1. Grade A+ / A (Score: 85–100) — Low Risk#

• Posture: Excellent defensive posture. Transport encryption is modern (TLS 1.2+), HTTPS is strictly enforced with HSTS, comprehensive HTTP security headers are deployed, and email domain records (SPF, DMARC) prevent spoofing.
• Action: Maintain automated continuous monitoring to prevent configuration drift.

2. Grade B / C (Score: 70–84) — Medium Risk#

• Posture: Adequate foundational encryption, but missing secondary defensive controls. Commonly caused by missing clickjacking headers, permissive DMARC policies (p=none), or absent MIME-sniffing protections.
• Action: Implement missing security headers in reverse proxy configurations.

3. Grade D (Score: 50–69) — High Risk#

• Posture: Significant perimeter deficiencies. Multiple high-severity checks failed, such as absent HSTS, cleartext transmission windows, or legacy TLS protocol negotiation.
• Action: Prioritize transport layer enforcement and web server header directives.

4. Grade F (Score: < 50) — Critical Risk#

• Posture: Immediate exploitation or browser warning hazard. The target has one or more Critical failures (e.g. invalid certificate, broken redirect chain, or complete absence of transport protection).
• Action: Immediate remediation required to prevent browser security warnings and data interception.

---

Why Missing Headers Trigger Meaningful Deductions#

A frequent question from site owners is: "My website uses HTTPS; why did my score drop from 100 to 70?"

Transport encryption (HTTPS) only encrypts data in transit between the client and server. It does not protect against:

1. SSL Stripping: Man-in-the-middle attackers downgrading the initial connection without HSTS.
2. Clickjacking: Malicious websites embedding your application in hidden iframes without X-Frame-Options or frame-ancestors.
3. Cross-Site Scripting (XSS): Untrusted scripts executing in the context of the user's browser without a Content-Security-Policy.

By applying calibrated deductions for these defensive omissions, SiteSecura encourages comprehensive, defense-in-depth engineering.