Web Security Scoring Criteria & Allocation Methodology
Every website and IP address analyzed by Skopeon Labs is evaluated against an objective, non-invasive standard derived from NIST, CIS, and OWASP guidelines. Here is how your score and letter grade are calculated.
Every perimeter begins with a pristine score of 100 before vulnerability deductions.
Assigned for immediate compromise vectors (expired TLS, open database ports, DNSBL blacklist).
Deductions for missing defense-in-depth headers, permissive DMARC, or missing CSP.
Proportional score bonus awarded for robust configuration across 40+ evaluated vectors.
The Scoring Formula
The composite score is calculated deterministically across verified observations without arbitrary rounding or hidden heuristics:
Score = Clamp0–100( 100 - (Critical × 18) - (Issues × 8) - (Warnings × 3) - BlacklistPenalties + PassBonus )X-Content-Type-Options: nosniff).round((PassCount / TotalAssessed) × 10) awards targets maintaining high baseline compliance.Severity Allocation Criteria & Technical Basis
Specific point weights are tied to empirical threat exposure models and industry security standards:
| Severity Tier | Point Impact | Qualifying Findings & Examples | Regulatory & Standard Basis |
|---|---|---|---|
| Critical | -18 Points each |
| NIST SP 800-52r2 CIS Controls v8 (Measure 7.1) Mandates immediate cryptographic validity and eradication of open perimeter services. |
| Security Issue | -8 Points each |
| OWASP ASVS 14.4 RFC 7489 (DMARC) RFC 6797 (HSTS) Direct protection against XSS, clickjacking, domain spoofing, and SSL-stripping. |
| Configuration Warning | -3 Points each |
| CIS Web Benchmark OWASP Secure Headers Defense-in-depth measures that limit information disclosure and drive-by exploitation. |
| Passing Checks | Up to +10 Points |
| NIST SP 800-115 Rewards defense-in-depth architectures with verified compliance across all 40+ vectors. |
Letter Grade Classification & Recommended Action
Scores map to executive letter grades that dictate remediation priority:
Robust Perimeter Security Posture
The attack surface demonstrates strong defense-in-depth. TLS 1.3 is enabled, modern HTTP security headers are deployed, email authentication is enforced, and no blacklist listings are active.
Acceptable Baseline, Hardening Recommended
Core transport security is sound, but defensive omissions exist—such as permissive DMARC policies, missing Content Security Policies, or absent defense headers that increase susceptibility to web threats.
Significant Vulnerabilities Detected
Multiple core security controls are absent or misconfigured. Vulnerable to credential interception, DNS spoofing, clickjacking, or permissive email impersonation.
Active Perimeter Exposure / Blacklisted
Emergency intervention required. The target possesses invalid/expired certificates, active blacklist listings on global spam/malware databases, or exposed internal database/management ports.
Industry Standards Alignment
Skopeon Labs scoring is aligned with globally acknowledged cybersecurity benchmarks:
NIST SP 800-115 & 800-52
Technical Guide to Information Security Testing and Assessment; Guidelines for TLS Implementation.
CIS Web Infrastructure Benchmarks
Center for Internet Security recommendations for web server hardening, cipher negotiation, and minimal port exposure.
OWASP ASVS & Top 10
Application Security Verification Standard baseline for cross-site scripting (XSS), framing, and content-injection defense.
IETF RFC Specifications
Strict conformance with RFC 6797 (HSTS), RFC 7489 (DMARC), RFC 8446 (TLS 1.3), and RFC 8659 (DNS CAA).