--- title: WatchFor Grade: One A+ to F Scale for Security, Speed & Email description: WatchFor Grade rates SSL/TLS, security headers, Core Web Vitals, CDN, mail servers, email health, DNS and MCP servers on one A+ to F scale, with every reason and fix shown. canonical: https://watchfor.io/grades --- Introducing the WatchFor grading system # WatchFor Grade One letter from A+ to F for the security, speed and delivery of what you run on the internet, with every reason behind it and the exact fix, graded the same way everywhere. [Grade your website](/smart-website-audit)[See every grade](#areas) A+ A B C D F One scale on every tool. D only appears where a rubric needs a step between C and F. ## Why we grade Security, speed and email delivery problems are easy to miss and hard to explain. A grade turns them into the one thing that matters first and the change that fixes it, measured from real probe locations with the same checks our monitors run, so you can fix the problem and confirm the fix in one place. ### A letter you can act on A long report is easy to file away. A C is not. The letter tells you in one glance whether something needs work today, and the list under it tells you what. ### The reasons are always visible No hidden score. Every grade shows the findings that set it, worst first, each with what it means in plain English and the exact change that fixes it: a header line, a DNS record, a server setting. ### The same rules everywhere TLS, headers, speed, mail, DNS and MCP servers are graded on one scale with one method. An A means the same thing on every tool, so you can compare areas and see which one to fix first. ### Honest when we couldn't measure If a server doesn't answer from our locations, a request times out or a check is blocked, you get no grade and the reason, never an F. A failure of our network is not a verdict on yours. ## How a grade is calculated Everything graded the same way, so an A means the same thing everywhere - 1 ### Start at A+ Every check begins with the best grade. Nothing has to be earned with points. - 2 ### Each finding can only cap the grade A finding sets the highest grade still possible: a missing Content-Security-Policy allows at most C, an outdated protocol at most B. The worst finding wins, so the letter is always explained by the first reason in the list. - 3 ### Versioned rules, published in full Every set of rules has a rules version, such as headers-2026.10, shown on the result and on the tool page next to the full rule table. When a rule changes, the version changes. - 4 ### Measured from real locations Grades are measured by WatchFor's own probes, not from your browser: the location nearest to you, and for mail, CDN and DNS answers, several regions or every location at once. Example: a security headers check C Weak Fix first: No Content-Security-Policy header - Start A+ - No Content-Security-Policy header max C - HSTS max-age is 30 days max B - No Permissions-Policy header max A The lowest cap is C, so the grade is C. Fixing the HSTS max-age alone changes nothing; adding a Content-Security-Policy lifts it to B, and fixing all three gets A+. Each finding comes with its fix, and for headers a ready-to-paste line for nginx, Apache, Caddy and Cloudflare. ### The same grade in the tool and the monitor Where a monitor measures the same thing, it uses the same rubric. An [SSL monitor](/ssl-monitoring) re-scans the TLS grade on a schedule and can alert you when it drops below the grade you pick. [Core Web Vitals](/core-web-vitals-monitoring) and [MCP](/mcp-monitoring) monitors show the same grade as the free tool on every result. ### Read the rules before you trust the letter Every tool page below ends with its grade scale and every rule in full. The Smart Website Checker's rubric is also in the [docs](/docs/reference/audit-grade). ## What we grade Four areas, every grade a free tool you can run now ### Security Is the connection private, and does the page defend itself? #### SSL/TLS Graded by the [SSL/TLS Grade](/ssl-grade-checker) A+ A B C F - Protocol versions, SSL 3.0 to TLS 1.3 - Weak ciphers: RC4, 3DES, NULL, EXPORT - Forward secrecy and post-quantum key exchange - Certificate trust, key size and signature Rules version tlsgrade-2026.10b Measured from The probe location nearest to you Note A certificate browsers do not trust is an F, labelled “Not trusted”: visitors get a full-page warning whatever else is configured. Monitor SSL monitors re-scan the grade on a schedule and can alert when it drops below the grade you pick. [Learn more](/ssl-monitoring) [Get this grade](/ssl-grade-checker) #### Security headers Graded by the [Security Headers Checker](/security-headers-checker) A+ A B C F - Content-Security-Policy, including unsafe-inline and wildcards - Strict-Transport-Security max-age, subdomains, preload - Clickjacking, MIME sniffing, Referrer and Permissions policies - Cookie flags: Secure, HttpOnly, SameSite Rules version headers-2026.10 Measured from The probe location nearest to you [Get this grade](/security-headers-checker) #### Mail server TLS Graded by the [Mail Server Checker](/mail-server-checker) A+ A B C F - TLS versions and ciphers on SMTP, IMAP and POP3 - Certificates mail apps and senders see - STARTTLS, and passwords offered before encryption Rules version mailgrade-2026.10 Measured from Three probe locations in different regions [Get this grade](/mail-server-checker) ### Speed How fast does it load, and is it delivered well everywhere? #### Core Web Vitals Graded by the [Core Web Vitals Checker](/core-web-vitals-checker) A+ A B C D F - Largest Contentful Paint and Cumulative Layout Shift - Total Blocking Time, the lab stand-in for INP - Time to First Byte and the Lighthouse performance score Rules version cwv-2026.10 Measured from A probe location with a real Chromium (lab data) Monitor Core Web Vitals monitors show the same grade from every audit. [Learn more](/core-web-vitals-monitoring) [Get this grade](/core-web-vitals-checker) #### CDN Graded by the [Global CDN Checker](/cdn-checker) A+ A B C D F - Availability and latency from every location - Whether the edge really caches - Consistent content and healthy edges per region Rules version cdn-2026.10 Measured from Every public probe location, three requests each Note Weighted categories add up to a score, and a location that cannot load the URL caps it. [Get this grade](/cdn-checker) ### Delivery Does your mail arrive, and can nobody send it in your name? #### Mail Server Checker Graded by the [Mail Server Checker](/mail-server-checker) A+ A B C F - Open relay test, stopped before any message is sent - Inbound MX reachable on port 25 from several regions - Reverse DNS, MTA-STS, TLS-RPT and DANE Rules version mailgrade-2026.10 Measured from Three probe locations, including one that can reach port 25 [Get this grade](/mail-server-checker) #### Email Health Graded by the [Email Health](/email-policy-checker) A+ A B C F - SPF: one record, its all policy, the 10-lookup limit - DMARC: policy, coverage and reporting - DKIM when you name a selector Rules version email-health-2026.10 Measured from The probe location nearest to you [Get this grade](/email-policy-checker) ### Infrastructure Will your name resolve, and do AI agents get a working server? #### DNS health Graded by the [DNS Health Checker](/dns-health-checker) A+ A B C F - Nameserver count, networks and lame delegation - Parent and child nameservers agree, SOA serials in sync - DNSSEC validates, CAA published - The same answer from every location Rules version dns-2026.10b Measured from Zone checks from the location nearest to you, answers from every location [Get this grade](/dns-health-checker) #### MCP server Graded by the [MCP Server Checker](/mcp-server-checker) A+ A B C F - Initialize handshake and protocol version - HTTPS, and OAuth discovery for protected servers - Tool inventory: descriptions, input schemas, unique names - Response time, declared vs working capabilities Rules version mcp-2026.10b Measured from The probe location nearest to you Monitor MCP monitors show the same grade from every check, inventory included when the monitor signs in. [Learn more](/mcp-monitoring) [Get this grade](/mcp-server-checker) ### The whole site at once One overall grade that brings the areas together. #### Smart Website Checker Graded by the [Smart Website Checker](/smart-website-audit) A+ A B C D F - SSL, HTTPS, DNS, domain expiry, headers, email, reputation, redirects, speed, IPv6 - One letter for the whole site, with the reasons behind it Rules version site-audit-2026.10 Measured from The location nearest to you, plus two more regions for reachability Note Section weights add up to a score; a critical finding caps the site at C and a fatal one at F. [Get this grade](/smart-website-audit) ## Frequently asked questions How WatchFor grades, and how it compares What is a WatchFor Grade? A letter from A+ to F that sums up one area of a website or service: its TLS setup, security headers, page speed, CDN delivery, mail servers, email authentication, DNS or MCP server. Each grade comes with the findings that set it, worst first, and the exact fix for each one. How is a grade calculated? Every check starts at A+. Each problem found sets the highest grade still possible, and the worst one wins, so nothing a site does well can hide something it does badly. The rules are published on each tool page as a table with its rules version. Two composite grades work slightly differently: the Smart Website Checker and the CDN Checker add up weighted sections into a score, and a serious finding still caps them. Why did I get no grade? Because we could not measure. If the server did not answer from our locations, the check timed out, or the location did not support the check, WatchFor shows the reason instead of a letter. An unreachable server is not graded F, because the problem might be on our side of the network. How does it compare to SSL Labs? SSL Labs made letter grades for TLS familiar. Our SSL/TLS grade checks the same core questions on the one WatchFor scale, so a certificate browsers do not trust is an F, labelled “Not trusted”, rather than a separate letter. Our scan runs from WatchFor's probe locations, and an SSL monitor can re-scan it on a schedule and alert you when the grade drops. How does it compare to securityheaders.com? securityheaders.com grades the HTTP response headers of a page. The WatchFor security headers grade checks the same family of headers, looks inside the Content-Security-Policy for unsafe-inline, unsafe-eval and wildcard sources, includes cookie flags when the page sets cookies, and gives the fix for nginx, Apache, Caddy and Cloudflare under each finding. Its rule table is published on the Security Headers Checker page. How does it compare to MXToolbox? MXToolbox is a long-standing set of mail and DNS lookups. WatchFor's Mail Server Checker grades every mail server of a domain (inbound MX, submission, IMAP and POP3) from three regions, and Email Health grades SPF and DMARC, each with the reasons and the fixes on one page. Is the grade the same in the free tool and in a monitor? Yes, where a monitor measures the same thing it uses the same rubric. An SSL monitor runs the same TLS grade scan as the free tool and can alert when the grade drops below the grade you pick. Core Web Vitals and MCP monitors show the same performance and MCP server grades as the free tools on every result; alerts on those grades are not available yet. Can scripts and AI agents get the grade? Yes. The same checks run over the REST API, the MCP server and the A2A agent as live diagnostics, and every graded check returns a grade object: the letter, its rules version and the findings that cap it, each with its fix. It is the same letter the free tool and the dashboard show, and an unreachable target comes back as not graded rather than F. Do grades change over time? The rules can, and when they do the rules version changes, so an old result always says which rules produced it. Your grade changes when your setup changes; run the tool again or turn the check into a monitor to keep watching it. ## Get your first grade in seconds Paste a URL into the Smart Website Checker for one grade across the whole site, or open any tool above for the full rubric of one area. Free, no signup. [Grade your website](/smart-website-audit)[All free tools](/free-tools) --- Canonical page: https://watchfor.io/grades · Site guide: https://watchfor.io/llms.txt