Telenegar Site Score Tool

The Telenegar Site Score Tool grades the security posture of a website and gives it a letter grade (A+ to F) and a percentage. It checks the things a visitor's browser can observe from the outside: HTTPS and TLS, security headers, cookies, information leaks, page metadata and basic performance settings. Think of it as an SSL Labs report that covers the whole site, not only the certificate.

Unlike Site Check, which is built for troubleshooting (what do other visitors see, and why does the site not load?), Site Score answers a different question: how well is this site hardened, and what should be fixed first?

It helps system administrators, developers and site owners find missing security headers, weak cookie settings and accidental information leaks, and confirm that a change actually improved the result.

# **Sign in.** The tool uses credits, so an account is required.
# **Enter the site.** Type a domain or URL such as ''example.com''.
# **Optional: tick Deep scan.** This runs extra checks, but only for a domain you have verified (see below).
# **Click Grade My Site.** The result appears in a few seconds.

Any public site can be graded with the standard scan. You do not need to own it.

At the top of the result you see the overall grade: a letter inside a circle with the percentage, and one bar for each category. Click a bar to jump to that category. Under it, every category lists its checks.

The bars and the numbers (for example 7 / 9) use the same color bands as the letter. A category with a red 0 / N has no visible bar, so the red number is what flags it.

Each category shows X passed / Y checked. Checks that were not tested are left out of Y.

Click any row that is not a pass to open it. Every result is explained in three parts: Finding (what was observed), Why (why it matters) and Remedy (what to change).

When some checks could not run (typically the deep-scan checks on a domain that is not verified), the result shows two grades side by side:

• Checks run (X/Y) — based only on the checks that actually ran.
• All Y checks — counts the checks that could not run as not passed.

A note under the grades reminds you that verifying your domain and running the deep scan closes the gap. When every check ran, only one grade is shown. The two grades keep a standard scan from looking like a perfect result when part of the picture is missing.

The grade is built from six categories. Their weights show how much each one matters:

<note> If a site sets no cookies, the Cookies category is shown as N/A and its weight is shared among the other categories, so the site is not penalized or rewarded for it. </note>

robots.txt and sitemap.xml are displayed with an info only tag. They help you see the site's setup but never change the score.

Some problems are serious enough that the grade cannot be good whatever else is right. A site with no HTTPS at all receives F, and so does a site where the deep scan finds an exposed sensitive file. A red notice explains why.

The Deep scan adds checks that are more intrusive, so they are allowed only for domains verified on your account:

• Deprecated protocols: whether the server still accepts old protocols such as SSL 3, TLS 1.0 or TLS 1.1.
• Certificate chain: whether the chain of certificates is complete and valid.
• Common exposure paths: whether sensitive files such as /.git/config, /.env, /.DS_Store, wp-config.php.bak and phpinfo.php can be downloaded. A file counts as exposed only when its content matches, not merely because the page answered.
• Full page weight: the HTML plus the scripts, stylesheets and images it loads.

If you tick Deep scan for a domain that is not verified, you still get the full standard grade. The deep-scan rows are shown as Not tested with the reason, and the extra price is not charged.

Open your account page and use Verified Domains to add the domain. Prove ownership with either of these:

• DNS record: add the TXT record shown for the domain, at the root of the domain.
• File: upload an empty file with the name shown to https://your-domain/telenegar-<token>.txt.

A redirect does not count as proof. The domain must answer directly. Verification is by DNS or file, never by e-mail.

• Standard scan: 6.5 credits.
• Deep scan: an additional 3 credits, charged only when the deep scan actually runs.
• If the target site cannot be fetched, it is not graded and no credits are charged.
• To protect the service and the sites being checked, scans are limited per minute and per hour, and the number of different sites you can grade per day is limited too. The limits depend on your account tier. Grading a site you already graded that day does not count as a new site.

The exact price is always shown on the tool page before you start.

• It does not attack the site. It sends ordinary requests, like a browser, and the deep scan only reads files that a visitor could request.
• It does not look inside the application, so it cannot find bugs in your code. A good grade means the outside is well configured, not that the site is free of vulnerabilities.
• It does not replace a penetration test or a vulnerability scan.

Run a score and read the Remedy of every row marked Missing, Misconfigured or Insecure. The category weights tell you where fixes matter most: TLS/HTTPS first, then security headers.

After adding a header or changing a cookie flag, run the score again and compare the grade.

Before a launch, make sure HTTPS redirects work, HSTS is on, no version numbers leak, and (for your own verified domain) that no .git or .env file is reachable.

The letter grade and the six category bars give a simple summary of the site's security hygiene.

• Telenegar Site Check Tool — Audit availability, redirects and SSL/TLS certificate health.
• Telenegar DNS Check Tool — Query raw DNS records, including the TXT record used for domain verification.

—-