A website security grade is a single letter summarising how well a website's publicly visible security configuration holds up against known standards and common attack vectors.
What gets graded
threatprobe.app checks across seven categories:
- HTTP security headers
- TLS/SSL configuration
- DNS & email security (SPF, DKIM, DMARC)
- Software disclosure
- Exposed sensitive files
- Open ports & services
- Reputation & blocklist status
Each check produces a pass, fail, or warning. Findings are weighted by severity — a critical finding (like an exposed credential file) impacts the grade far more than a missing minor header.
How the grade is calculated
- Each category produces a score based on how many checks pass and their severity
- Category scores are weighted — exposed files and TLS matter more than minor header issues
- Weighted scores combine into a final grade
A single critical finding can pull an otherwise solid configuration down to a D or F.
What each grade means
- A — strong configuration, no critical or high findings
- B — good fundamentals, minor gaps in best practices
- C — meaningful security gaps, some protections missing or misconfigured
- D — significant issues, one or more high-severity findings
- F — serious, likely-exploitable problems requiring immediate attention
The grade is a starting point, not the destination
Two sites can both receive a C with very different problems. Always read the individual findings rather than acting only on the letter.