---
title: WatchFor website audit grade: the full rubric
description: The exact rubric behind the letter the Smart Website Audit gives a site — what each section is worth, what caps a grade regardless of points, and why a single letter is never the whole answer.
canonical: https://watchfor.io/docs/reference/audit-grade
---

# WatchFor website audit grade: the full rubric

The exact rubric behind the letter the Smart Website Audit gives a site — what each section is worth, what caps a grade regardless of points, and why a single letter is never the whole answer.

The [Smart Website Audit](/smart-website-audit) ends with a letter. This page is
the rubric behind it, in full, so the letter can be checked rather than trusted.

The grade is deterministic: the same findings always produce the same letter.
There is no model, no weighting that shifts with the wind, and no scoring that
depends on who is asking.

## The short version

Every audit starts at 100 points. Each section can cost points — half its weight
for a warning, all of it for a critical finding. Then the caps apply, and they
matter more than the arithmetic.

## What each section is worth

| Section | Weight | What it looks at |
| --- | --- | --- |
| SSL certificate | 18 | Validity, chain, issuer, days remaining |
| HTTPS response | 12 | Whether the site answers, and with what status |
| Domain | 12 | Registration expiry, registrar, registry status flags |
| Security headers | 12 | HSTS and the other recommended response headers |
| DNS | 12 | A, AAAA, NS, SOA, CAA and MX sanity |
| Email policy | 10 | SPF and DMARC (see the note below on DKIM) |
| Reputation | 8 | Mail blacklists the site's address appears on |
| Addresses and redirects | 8 | One canonical host, and http:// redirecting to https:// |
| Performance | 4 | Time to first byte and total response time |
| IPv6 | 2 | Whether an advertised AAAA record actually answers |
| Protocols | 2 | HTTP/2 support (HTTP/3 is reported, never scored) |
| Reachability | 0 | Reported, never scored |
| CDN | 0 | Reported, never scored |

Two sections carry no weight, for the same reason: we cannot tell what they
mean from outside, and a grade should not be built on a guess.

**Reachability** requests the page from up to three probe locations in
different regions and shows what each one saw. When one region gets a 403 and
the others get the page, the cause is as often a deliberate geo-block or a bot
rule that dislikes the network our probe runs on as it is a fault — and the
report says so in as many words. Deducting for something we have just admitted
we cannot interpret would be a guess with a number attached. So the finding is
reported in full, named location by location, and costs nothing. The one
exception is a site nothing can reach at all, which is not a regional question
and is already fatal in the HTTPS section.

**CDN** carries no weight because having one is a choice, not a virtue, and a
small site served straight from its origin is not worse off for it.

HTTP/3 is reported and never scored, for the same reason: its gains show up on
lossy mobile networks rather than on a desk, and plenty of well-run sites do
without it. HTTP/2 is different — it is a one-line change on every current web
server, so a site still answering over HTTP/1.1 loses the point. The section's
traffic light stays informational either way; nothing here stops a page
rendering.

## What caps a grade

Points decide the difference between an A and a B. They never decide whether
something broken can score well.

| Finding | Result |
| --- | --- |
| The site does not answer at all | **F** |
| The certificate has expired, or does not validate to a trusted root | **F** |
| The domain registration has lapsed, or the registry has it on hold | **F** |
| Any section has a critical finding | **no better than C** |

The reason for a capped grade is always printed next to it. A letter that cannot
explain itself is worse than no letter.

## Letters

| Score | Letter |
| --- | --- |
| 97–100 | A+ |
| 90–96 | A |
| 80–89 | B |
| 70–79 | C |
| 60–69 | D |
| below 60 | F |

## Two things the grade deliberately does not do

**It does not punish a site for what we could not measure.** A probe that times
out costs nothing, and the report names the section it could not check, so a
score that moves by a few points between runs can be explained rather than
guessed at.

**It does not count DKIM.** DKIM records live at a selector name that the domain
chooses, and the audit tries a list of common ones. A domain using a custom
selector would look unsigned when it is not, and no audit should mark a site
down for something it merely failed to find. DKIM is still reported — it just
does not move the number.

## The grade and the section lights

The card at the top of the report is coloured by the letter: green for an A or
A+, amber for a B or C, red below that. It can be trusted not to flatter a
broken site, because any critical finding caps the grade at C — a green card
cannot appear over one.

The coloured dot on each section answers a narrower question: is this part
working. Those two do sometimes disagree, on purpose. A site with no security
headers renders perfectly for every visitor, so its section light stays
informational, and it still loses points here, because hardening is exactly what
a grade is for. The same is true in reverse: a missing IPv6 address is worth a
mention and two points, not an amber verdict over an otherwise excellent site.

Read both. The letter is a summary, not a replacement.

---

Canonical page: https://watchfor.io/docs/reference/audit-grade · All docs: https://watchfor.io/docs · Site guide: https://watchfor.io/llms.txt