Explanations & scoring methodology

Each check produces a finding with a status and a weight. The weighted findings of a module yield a percentage, which is converted into a letter grade (A+ … F). The home page combines all modules into an overall grade.

• pass – passed (full points)
• good – fulfilled, but does not count toward the grade (optional hardening)
• warn – room for improvement (half points)
• fail – problem/risk (0 points)
• info / skip – purely informational or not testable (does not count toward the grade)

Rating caps (modeled on SSL Labs)

A single serious finding must not be averaged away by many "pass" results. For this reason, certain findings cap the module grade regardless of the average (minimum logic):

• Cap A-: no TLS 1.3.
• Cap B: legacy TLS 1.0/1.1, no Forward Secrecy, no AEAD ciphers, incomplete certificate chain, weak DH parameters, RC4.
• Cap C: RC4/3DES with TLS 1.1+, cleartext-only MX (no STARTTLS), DMARC p=none, DANE-TLSA without DNSSEC.
• Cap F: expired/too-weak certificate, NULL/export/anonymous ciphers, expired DNSSEC signatures.
• T (Trust) or M (Mismatch): untrusted certificate or certificate that does not match the hostname – overrides the letter grade.

Methodology based on the SSL Labs Server Rating Guide, Mozilla, OWASP, and the relevant RFCs.