Reading your security grade

When a security scan finishes, the first thing you see is a single letter grade. It is designed to answer one question in a second, "roughly how safe is this site?", before you dig into the detail. This page explains what that grade means, how the findings underneath it are organised, and how to decide what to fix first.

The overall grade and score

Every completed scan gets one overall grade, from A+ at the top down through A, B, C and D, each with plus and minus steps, to F at the bottom, along with a numeric score out of 100 that the letter summarises. Think of it the way you would a school grade:

• A+ or A means a strong, well-configured site with no serious issues. Keep it there.
• B or C means a mostly-sound site with real gaps worth closing, often quick wins like a missing header or a DNS record.
• D or F means something serious is exposed and you should treat the top findings as urgent.

The score is driven by the findings: the more serious an issue and the more of them there are, the lower it goes. Because it is calculated the same way every time, you can compare one scan of a site to the next and see genuine progress, not just a different set of words.

Grades for each category

Beneath the headline grade, each area of the scan is graded on its own, for example your security headers, your TLS configuration, your DNS records and your email security. This is the fastest way to find where the trouble is. An overall C with an A for TLS but an F for email security tells you immediately to go and fix your SPF and DMARC records, rather than hunting through everything.

How findings are grouped by severity

Every individual finding carries a severity. The report groups findings by category, puts the category with the worst finding first, and lists each group worst-first in this order:

• Critical. A serious, exploitable weakness. Fix these first, today if you can.
• High. A significant risk that a motivated attacker could use. Fix soon.
• Medium. A real weakness worth closing, but not an emergency on its own. Missing HSTS or a cookie without HttpOnly often lands here.
• Low. Minor hardening, good to tidy up. A disclosed server version, for example.
• Info. Not a vulnerability, just something worth knowing about your setup.

Each finding also carries supporting detail where the scanner has it: the affected URL, the evidence it saw, a suggested solution and a CWE reference. The PDF export also lists links you can follow to read more.

What the AI explanation gives you

Raw findings are written for security professionals. To make them usable, TLDTrack passes the results to an AI reviewer that produces a customer-facing summary. It gives you:

• An executive summary. Three to five sentences that name your grade in plain English, call out the single biggest business risk in concrete terms (lost trust, downtime, account takeover, email spoofing), note what is already going well, and say how achievable the fixes are.
• A headline risk. One short sentence naming the most serious concrete risk, so you know the one thing to care about even if you read nothing else.
• Top actions. A prioritised, numbered list. Each action tells you what to do, why it matters for your business, and how to do it with concrete steps tailored to your stack, plus an effort label of quick, medium or major.
• Grouped fixes. Related findings gathered into themes, each with a copy-pasteable snippet (a DNS record, an nginx directive, a headers block) that fixes several findings at once.

How to prioritise the fixes

You do not need to work top to bottom through every finding. A sensible order:

1. 1
   Read the headline risk and executive summary first, to understand the shape of the problem.
2. 2
   Clear any critical and high findings before anything else. These are what an attacker would reach for.
3. 3
   Work the top actions list next. It is ordered so that quick wins with real impact float to the top, which is the fastest way to lift your grade.
4. 4
   Use the grouped fixes to knock out several related medium and low findings in one change.
5. 5
   Treat info findings as reading material, not a to-do list.
6. 6
   Re-run the scan when you are done and confirm the grade has moved and the issues are gone.

Good to know

• The AI enrichment is best-effort. If it cannot run for a scan, you still get the full grade, the category grades and every raw finding, just without the plain-English layer on top.
• The AI is told to keep informational findings out of the top actions, so the list focuses on genuine issues worth fixing.
• The grade is a snapshot from the moment the scan ran. Deploy a change, re-scan, and watch it move.
• You can export any scan, grade and all, as a PDF to share with a client or your team.

Where to see your grade