====== Telenegar Site Score Tool ====== The **Telenegar Site Score Tool** grades the security posture of a website and gives it a **letter grade (A+ to F) and a percentage**. It checks the things a visitor's browser can observe from the outside: HTTPS and TLS, security headers, cookies, information leaks, page metadata and basic performance settings. Think of it as an SSL Labs report that covers the whole site, not only the certificate. Unlike [[tools:sitecheck|Site Check]], which is built for troubleshooting (what do other visitors see, and why does the site not load?), Site Score answers a different question: **how well is this site hardened, and what should be fixed first?** It helps system administrators, developers and site owners find missing security headers, weak cookie settings and accidental information leaks, and confirm that a change actually improved the result. ---- ===== How to Run a Site Score ===== # **Sign in.** The tool uses credits, so an account is required. # **Enter the site.** Type a domain or URL such as ''example.com''. # **Optional: tick Deep scan.** This runs extra checks, but only for a domain you have verified (see below). # **Click Grade My Site.** The result appears in a few seconds. Any public site can be graded with the standard scan. You do **not** need to own it. ---- ===== Reading the Result ===== At the top of the result you see the **overall grade**: a letter inside a circle with the percentage, and one bar for each category. Click a bar to jump to that category. Under it, every category lists its checks. ==== Grades and colors ==== ^ Score ^ Letter ^ Color ^ | 97% and above | A+ | green | | 85% - 96% | A | green | | 70% - 84% | B | yellow | | 50% - 69% | C | orange | | below 50% | F | red | The bars and the numbers (for example **7 / 9**) use the same color bands as the letter. A category with a red **0 / N** has no visible bar, so the red number is what flags it. ==== Check statuses ==== ^ Status ^ Meaning ^ | **Pass** | The check is satisfied. | | **Missing** | Something recommended is absent (for example a security header). | | **Misconfigured** | It is present but set in a weak or incorrect way. | | **Insecure** | A real security problem. These rows are opened automatically. | | **Not tested** | The check could not be run (for example deep-scan checks on an unverified domain). It is **not counted** for or against you. | Each category shows **X passed / Y checked**. Checks that were not tested are left out of //Y//. Click any row that is not a pass to open it. Every result is explained in three parts: **Finding** (what was observed), **Why** (why it matters) and **Remedy** (what to change). ==== Two grades ==== When some checks could not run (typically the deep-scan checks on a domain that is not verified), the result shows **two grades** side by side: * **Checks run (X/Y)** — based only on the checks that actually ran. * **All Y checks** — counts the checks that could not run as not passed. A note under the grades reminds you that verifying your domain and running the deep scan closes the gap. When every check ran, only one grade is shown. The two grades keep a standard scan from looking like a perfect result when part of the picture is missing. ---- ===== What Is Checked ===== The grade is built from six categories. Their weights show how much each one matters: ^ Category ^ Weight ^ What it looks at ^ | **TLS / HTTPS** | 30 | Whether the site works over HTTPS, the TLS version negotiated (TLS 1.3 support), certificate validity and expiry, HSTS, and the redirect from HTTP to HTTPS. | | **Security Headers** | 20 | ''Content-Security-Policy'' (script sources), ''X-Frame-Options'', ''X-Content-Type-Options'', ''Referrer-Policy'' and ''Permissions-Policy''. | | **Cookies** | 15 | The ''Secure'', ''HttpOnly'' and ''SameSite'' flags on the cookies the site sets. | | **Information Disclosure** | 15 | Server and software versions revealed in headers (for example ''Server'' and ''X-Powered-By''), allowed HTTP methods, directory listing, and WordPress-specific leaks such as user enumeration, ''xmlrpc.php'' and ''readme.html''. | | **Metadata Hygiene** | 10 | Character-set declaration (header and ''meta'' tag, with a mismatch warning), page language, viewport tag, favicon. | | **Performance Hygiene** | 10 | Compression, IPv6 support and the size of the HTML document. | If a site sets **no cookies**, the Cookies category is shown as **N/A** and its weight is shared among the other categories, so the site is not penalized or rewarded for it. ''robots.txt'' and ''sitemap.xml'' are displayed with an **info only** tag. They help you see the site's setup but **never change the score**. ==== Hard cap ==== Some problems are serious enough that the grade cannot be good whatever else is right. A site with **no HTTPS at all** receives **F**, and so does a site where the deep scan finds an **exposed sensitive file**. A red notice explains why. ---- ===== Deep Scan ===== The **Deep scan** adds checks that are more intrusive, so they are allowed **only for domains verified on your account**: * **Deprecated protocols:** whether the server still accepts old protocols such as SSL 3, TLS 1.0 or TLS 1.1. * **Certificate chain:** whether the chain of certificates is complete and valid. * **Common exposure paths:** whether sensitive files such as ''/.git/config'', ''/.env'', ''/.DS_Store'', ''wp-config.php.bak'' and ''phpinfo.php'' can be downloaded. A file counts as exposed only when its **content** matches, not merely because the page answered. * **Full page weight:** the HTML plus the scripts, stylesheets and images it loads. If you tick Deep scan for a domain that is **not verified**, you still get the full standard grade. The deep-scan rows are shown as **Not tested** with the reason, and the extra price is **not charged**. ==== Verifying a domain ==== Open your account page and use **Verified Domains** to add the domain. Prove ownership with **either** of these: * **DNS record:** add the ''TXT'' record shown for the domain, at the root of the domain. * **File:** upload an empty file with the name shown to ''https://your-domain/telenegar-.txt''. A redirect does **not** count as proof. The domain must answer directly. Verification is by DNS or file, never by e-mail. ---- ===== Cost ===== * **Standard scan:** 6.5 credits. * **Deep scan:** an additional 3 credits, charged **only when the deep scan actually runs**. * If the target site **cannot be fetched**, it is not graded and **no credits are charged**. * To protect the service and the sites being checked, scans are limited **per minute** and **per hour**, and the number of **different sites** you can grade per day is limited too. The limits depend on your account tier. Grading a site you already graded that day does not count as a new site. The exact price is always shown on the tool page before you start. ---- ===== What Site Score Does Not Do ===== * It does **not attack** the site. It sends ordinary requests, like a browser, and the deep scan only reads files that a visitor could request. * It does **not look inside** the application, so it cannot find bugs in your code. A good grade means the //outside// is well configured, not that the site is free of vulnerabilities. * It does **not replace** a penetration test or a vulnerability scan. ---- ===== Key Use Cases & Diagnostics ===== ==== 1. Where do I start hardening a site? ==== Run a score and read the **Remedy** of every row marked Missing, Misconfigured or Insecure. The category weights tell you where fixes matter most: TLS/HTTPS first, then security headers. ==== 2. Verifying a change ==== After adding a header or changing a cookie flag, run the score again and compare the grade. ==== 3. Checking a new deployment ==== Before a launch, make sure HTTPS redirects work, HSTS is on, no version numbers leak, and (for your own verified domain) that no ''.git'' or ''.env'' file is reachable. ==== 4. Reporting to a client or manager ==== The letter grade and the six category bars give a simple summary of the site's security hygiene. ---- ===== Related Documentation & Tools ===== * [[tools:sitecheck|Telenegar Site Check Tool]] — Audit availability, redirects and SSL/TLS certificate health. * [[tools:dnscheck|Telenegar DNS Check Tool]] — Query raw DNS records, including the ''TXT'' record used for domain verification. ----