What website security grades A to F mean
Short answer: every site starts at 100 points. Each issue found subtracts points by severity (critical 40, high 20, medium 8, low 3), with a cap per category. 90+ is an A, 75+ a B, 60+ a C, 40+ a D, below 40 an F. Any high-risk issue limits the grade to B, one critical issue limits it to D, and two or more critical issues mean F.
The bands
| Grade | Score | What it usually means |
|---|---|---|
| A | 90–100 | The basics are in place. Only minor hardening is left. |
| B | 75–89 | Solid, with a few missing protections, or one high-risk issue to fix. |
| C | 60–74 | Several gaps attackers commonly look for. |
| D | 40–59 | Serious gaps, or a critical issue such as an invalid or expired certificate. |
| F | 0–39 | Fix now: multiple critical issues or many high-risk ones. |
How points are subtracted
- Critical: 40 points. Example: an expired or untrusted certificate.
- High: 20 points. Examples: an outdated TLS version (1.0/1.1), a certificate expiring within 14 days, a PHP version that no longer gets security fixes.
- Medium: 8 points. Examples: no HSTS, no Content-Security-Policy, no clickjacking protection, no SPF or DMARC record.
- Low: 3 points. Examples: no Referrer-Policy, no Permissions-Policy, server or PHP version numbers on show.
- Info: 0 points. Shown for context only.
Each category (for example headers, TLS, email, WordPress) has a maximum deduction, so many small header issues can’t sink the grade on their own. The headers category is capped at 24 points.
The safety caps
Points alone could hide one dangerous problem, so three rules apply after the score:
- Any high issue: the grade is at most B.
- One critical issue: the grade is at most D.
- Two or more critical issues: the grade is F.
Two worked examples
- Missing CSP (8) + missing HSTS (8) + missing Referrer-Policy (3) = 19 points. 100 − 19 = 81, a B.
- An expired certificate (40) = 60 points, which would be a C, but the critical cap lowers it to a D.
How to raise your grade fastest
- Fix anything critical first (certificates, exposed files).
- Clear every high issue, because one alone holds you at B.
- Add the missing headers: copy-paste lines for your server.
- Add SPF and DMARC: records for Google Workspace and Microsoft 365.
- Re-scan to confirm.
Free grade vs deep scan
The free grade comes from passive checks only. A deep scan (for verified owners, with consent) runs more tests, so it can find issues the free grade can’t see, and the grade can go down as well as up.
Frequently asked questions
Is an A grade the same as being secure?
No. An A means the issues visible from outside are in good shape. It can’t see your server’s files, passwords or backups.
Why is my grade capped at B when my score is above 90?
Because there is at least one high-risk issue. Fix it and the cap is removed.
Why did my grade change without me changing anything?
Certificates get closer to expiry, new vulnerabilities are published for software you run, and your host or CDN can change headers.
Do other security graders use the same scale?
No. Every tool weighs issues differently, so grades from different tools aren’t directly comparable. This page describes HackGrade’s scale only.