---
title: WatchFor website audit grade: the full rubric
description: The exact rubric behind the letter the Smart Website Audit gives a site — what each section is worth, what caps a grade regardless of points, and why a single letter is never the whole answer.
canonical: https://watchfor.io/docs/reference/audit-grade
---

# WatchFor website audit grade: the full rubric

The exact rubric behind the letter the Smart Website Audit gives a site — what each section is worth, what caps a grade regardless of points, and why a single letter is never the whole answer.

The [Smart Website Audit](/smart-website-audit) ends with a letter. This page is
the rubric behind it, in full, so the letter can be checked rather than trusted.

The grade is deterministic: the same findings always produce the same letter.
There is no model, no weighting that shifts with the wind, and no scoring that
depends on who is asking.

It is one of the [WatchFor Grades](/grades): the same A+ to F scale as the
SSL/TLS, security headers, mail, Core Web Vitals, Email Health, DNS health and
MCP server grades. Those start at A+ and let each finding only cap the letter;
this one, as the overall grade, adds weighted sections into a score first and
then applies the same kind of caps.

The rules on this page are rules version `site-audit-2026.10`, the id every
audit result carries. Results from before October 2026 show the same rules
under their old number, 1.2.

## The short version

Every audit starts at 100 points. Each section can cost points — half its weight
for a warning, all of it for a critical finding. Then the caps apply, and they
matter more than the arithmetic.

## What each section is worth

| Section | Weight | What it looks at |
| --- | --- | --- |
| SSL certificate | 18 | Validity, chain, issuer, days remaining |
| HTTPS response | 12 | Whether the site answers, and with what status |
| Domain | 12 | Registration expiry, registrar, registry status flags |
| Security headers | 12 | HSTS and the other recommended response headers |
| DNS | 12 | A, AAAA, NS, SOA, CAA and MX sanity |
| Email policy | 10 | SPF and DMARC (see the note below on DKIM) |
| Reputation | 8 | Mail blacklists the site's address appears on |
| Addresses and redirects | 8 | One canonical host, and http:// redirecting to https:// |
| Performance | 4 | Time to first byte and total response time |
| IPv6 | 2 | Whether an advertised AAAA record actually answers |
| Protocols | 2 | HTTP/2 support (HTTP/3 is reported, never scored) |
| Reachability | 0 | Reported, never scored |
| CDN | 0 | Reported, never scored |

Two sections carry no weight, for the same reason: we cannot tell what they
mean from outside, and a grade should not be built on a guess.

**Reachability** requests the page from up to three probe locations in
different regions and shows what each one saw. When one region gets a 403 and
the others get the page, the cause is as often a deliberate geo-block or a bot
rule that dislikes the network our probe runs on as it is a fault — and the
report says so in as many words. Deducting for something we have just admitted
we cannot interpret would be a guess with a number attached. So the finding is
reported in full, named location by location, and costs nothing. The one
exception is a site nothing can reach at all, which is not a regional question
and is already fatal in the HTTPS section.

**CDN** carries no weight because having one is a choice, not a virtue, and a
small site served straight from its origin is not worse off for it.

HTTP/3 is reported and never scored, for the same reason: its gains show up on
lossy mobile networks rather than on a desk, and plenty of well-run sites do
without it. HTTP/2 is different — it is a one-line change on every current web
server, so a site still answering over HTTP/1.1 loses the point. The section's
traffic light stays informational either way; nothing here stops a page
rendering.

## What caps a grade

Points decide the difference between an A and a B. They never decide whether
something broken can score well.

| Finding | Result |
| --- | --- |
| The site does not answer at all | **F** |
| The certificate has expired, or does not validate to a trusted root | **F** |
| The domain registration has lapsed, or the registry has it on hold | **F** |
| Any section has a critical finding | **no better than C** |

The reason for a capped grade is always printed next to it. A letter that cannot
explain itself is worse than no letter.

## Letters

| Score | Letter |
| --- | --- |
| 97–100 | A+ |
| 90–96 | A |
| 80–89 | B |
| 70–79 | C |
| 60–69 | D |
| below 60 | F |

## Two things the grade deliberately does not do

**It does not punish a site for what we could not measure.** A probe that times
out costs nothing, and the report names the section it could not check, so a
score that moves by a few points between runs can be explained rather than
guessed at.

**It does not count DKIM.** DKIM records live at a selector name that the domain
chooses, and the audit tries a list of common ones. A domain using a custom
selector would look unsigned when it is not, and no audit should mark a site
down for something it merely failed to find. DKIM is still reported — it just
does not move the number.

## The grade and the section lights

The card at the top of the report is coloured by the letter: green for an A or
A+, amber for a B or C, red below that. It can be trusted not to flatter a
broken site, because any critical finding caps the grade at C — a green card
cannot appear over one.

The coloured dot on each section answers a narrower question: is this part
working. Those two do sometimes disagree, on purpose. A site with no security
headers renders perfectly for every visitor, so its section light stays
informational, and it still loses points here, because hardening is exactly what
a grade is for. The same is true in reverse: a missing IPv6 address is worth a
mention and two points, not an amber verdict over an otherwise excellent site.

Read both. The letter is a summary, not a replacement.

---

Canonical page: https://watchfor.io/docs/reference/audit-grade · All docs: https://watchfor.io/docs · Site guide: https://watchfor.io/llms.txt