DE EN IT

~/blog / website-security-report-card

A school report card for your website: security headers, e-mail protection and certificate, graded like at school

· Daniele Michelin · ~2 min read · Also in DE · IT

Security checks usually end in a wall of red and green lines. This one ends in a report card you can show your colleagues, with a grade, a verdict and a teacher who has opinions.

#security #http #dmarc #tls #tools

Topics: DNS, mail & certificates Linux troubleshooting Security & patches

daniele@mikweb: ~/blog — less website-security-report-card.md

Try it first: type a domain into the report card, wait a few seconds, and you get a school report for that website. There is a demo button with my own site, which gets an A.

What is graded

  • Security headers (40 %): HSTS, Content-Security-Policy, nosniff, frame protection, Referrer-Policy, Permissions-Policy, COOP and whether the server gives away its version. Same scoring as the header checker.
  • E-mail protection (35 %): SPF and how it ends (-all or ~all), DMARC and its policy (reject, quarantine or none), DMARC reports and MTA-STS. This decides how easily someone can send forged mail in your domain's name.
  • TLS certificate (25 %): valid, trusted, matching the name, days left and the protocol version.

The overall score becomes a grade: A to F in English, 1 to 6 in the German version, marks out of ten in the Italian one. A to C passes, D is at risk, F repeats the year.

The teacher remarks

Below the grades the class teacher adds two to four remarks, picked from the weakest points: "Content-Security-Policy is missing. Homework due next week." or "DMARC at p=none: watches carefully, never steps in." They are funny, but every one of them points at a real finding, and each subject links to the detailed tool that shows how to fix it.

Built to be shared

Every report card gets its own link. When you share it on WhatsApp, LinkedIn or Telegram, the preview shows the card itself, with the grades and the red circle around the overall grade, because messengers do not run JavaScript and get a server-rendered image instead. The idea: you check your site, post your grade, and a colleague checks theirs.

How it works

One PHP endpoint runs the three existing checks of this site in a single request, turns their results into grades, writes the remarks in three languages and draws the share image with GD. Nothing else is stored, the checks only read public information (HTTP headers, DNS records, the certificate), and each visitor can request ten report cards per hour.

If you want to compare with well-known sites, the header ranking and the e-mail ranking show the same checks for about 100 domains.

New articles by e-mail

One e-mail per new article. No tracking, unsubscribe any time. As a thank-you after confirming: my “Server operations & patching” checklist (PDF).

daniele@mikweb: ~/blog — ls

More articles

Can these domains be spoofed? We checked SPF and DMARC of 102 well-known domains, and only half of the banks reject forged mailSPF, DMARC and MTA-STS of 102 well-known domains: 59 reject forged mail, 21 only monitor with p=none, 6 have no DMARC. Banks, Germany and Italy compared.We graded the security headers of 57 big websites: only 21 ship an effective CSPA scan of 57 well-known sites: HSTS is common, CSP is not. Results by header, the four sites with grade A, and how to read the numbers fairly.HTTP security headers in ten minutes: a safe starter set for nginx and how to test itHSTS, CSP, X-Content-Type-Options, Referrer-Policy, Permissions-Policy: what each security header does, a copy-paste nginx starter set, and how to test it.

← All articles