---
title: WatchFor Grade: one A+ to F scale for security headers, speed, DNS, MCP servers and email
description: A pile of findings doesn't tell you what to fix first, and every tool used to grade in its own way. WatchFor Grade puts our graded tools on one A+ to F scale…
canonical: https://watchfor.io/changelog/2026-10-05-watchfor-grade
---

[All updates](/changelog#2026-10-05-watchfor-grade) ✨ New Oct 5, 2026 · v 9.4.8

# WatchFor Grade: one A+ to F scale for security headers, speed, DNS, MCP servers and email

A pile of findings doesn't tell you what to fix first, and every tool used to grade in its own way. WatchFor Grade puts our graded tools on one A+ to F scale: every grade starts at A+, each problem can only lower it, and the reasons and exact fixes sit under the letter. New grades for security headers, Core Web Vitals, DNS health and MCP servers, and a real rubric for Email Health. A server we can't reach gets no grade, never an F.

## What's new

- [Security Headers Checker](/security-headers-checker): a grade for CSP (including unsafe-inline, unsafe-eval and wildcard sources), HSTS, clickjacking protection, nosniff, Referrer-Policy, Permissions-Policy and cookie flags, with a ready-to-paste fix for nginx, Apache, Caddy and Cloudflare under each finding.

- [Core Web Vitals Checker](/core-web-vitals-checker): a performance grade from LCP, CLS, Total Blocking Time, server response time and the Lighthouse score, using Google's thresholds. It's lab data from one run, and the result says so.

- [DNS Propagation Checker](/dns-propagation-checker): a DNS health grade for the zone: nameserver count and networks, lame delegation, parent and child agreement, SOA serials and timers, DNSSEC, CAA, and whether every probe location gets the same answer.

- [MCP Server Checker](/mcp-server-checker): a grade for the handshake, protocol version, HTTPS, sign-in discovery on protected servers, secrets in the URL, the tool inventory and response time. Open servers are not marked down for being open.

- [Email Health](/email-policy-checker): a capped rubric for SPF and DMARC replaces the old letter, which counted records rather than reading them.

- [SSL/TLS Grade](/ssl-grade-checker): a certificate browsers don't trust (broken chain, wrong name or expired) is now an F, labelled "Not trusted", instead of a separate T, so every grade uses the same A+ to F scale. TLS grade alerts you set in the dashboard fire exactly as before.

## The same rules everywhere

Every grade has a versioned rubric id (for example headers-2026.10 ), and each tool page ends with the grade scale and every rule in full. Core Web Vitals and MCP monitors show the same grade as the free tool. How it all works, and every area we grade: [/grades](/grades).

Share this update

---

Canonical page: https://watchfor.io/changelog/2026-10-05-watchfor-grade · Site guide: https://watchfor.io/llms.txt