SSL/TLS and domain security grading
How the A+–F grade is computed — TLS configuration, certificate, HTTP security headers and cookies — the three scoring modes, and the domain grade from RDAP, DNSSEC and SPF/DKIM/DMARC.
Two monitor types produce a letter grade. The SSL/TLS Security monitor grades an HTTPS endpoint's transport and headers; the Domain Security monitor grades a domain's registry record, DNSSEC and mail authentication. Both alert on security_grade_downgraded and security_grade_recovered, and both can be published on a trust page.
SSL/TLS Security: what is scored
| Category | Points | Checks |
|---|---|---|
| TLS / SSL configuration | 80 | Protocol versions offered (legacy TLS 1.0/1.1 and SSLv3 probed), weak and legacy cipher suites, certificate expiry and chain trust, key strength (≥ 2048-bit RSA or a modern curve), signature algorithm, CAA issuer alignment, OCSP revocation, session resumption and other handshake features. |
| HTTP security headers | 30 (browser pages) / 10 (API responses) | HSTS (tiered: 1-year + includeSubDomains for full marks), Content-Security-Policy (six graded properties, 12 points), X-Content-Type-Options, clickjacking protection, Referrer-Policy, Permissions-Policy. |
| Cookies | 10, excluded when none are set | Secure, HttpOnly, SameSite — weakest cookie wins. |
The grade is the percentage of available points: A+ ≥ 95, A ≥ 90, B ≥ 80, C ≥ 70, D ≥ 60, F below. An HTML response is graded as a browser page; JSON and other content types as an API response, where browser-page headers are reported but not scored. The free security headers grader uses exactly the header and cookie rules.
Scoring modes
security_scoring_mode decides how much of the assessment counts toward the grade. Everything a mode leaves out is still checked and shown as informational.
- low (default) — transport only: TLS configuration plus certificate trust.
- medium — adds HTTP security headers.
- high — every category counts, including cookies, CORS, content, redirects and exposure findings.
{
"type": "light_security",
"target": "https://app.example.com",
"config": {
"security_scoring_mode": "medium",
"dns_resolver": "1.1.1.1:53"
}
}Domain Security
The Domain Security monitor works from public sources only — no registrar credentials. It records the RDAP registry entry (expiry, status flags such as transfer lock, registrar, nameservers), validates DNSSEC, and checks the SPF, DKIM and DMARC records. Each is scored into a domain grade, and any difference in the registry record, DNSSEC state or mail records opens a change event with before and after.
Plan availability: the light TLS monitor (handshake and expiry) is on every plan; SSL/TLS Security grading with active port and path probes, and Domain Security, from Team.