Read your report
What your grade means, how each issue is explained, and what the report checked and did not check.
Every scan ends in a report on your site's page. The Overview tab shows the latest result and the things to fix. Scans lists every scan, Auto-check sets up regular checks, Repairs keeps the repairs you recorded and Settings holds the rest.
Your grade
Your site gets a score out of 100 and a letter.
| Grade | Score | In plain words | What it means |
|---|---|---|---|
| A | 85 and up | Good coverage | Locked tight. Nothing an attacker could easily use turned up, so keep it that way. |
| B | 70 and up | Looking good | Nearly there. Nothing serious turned up, just a couple of small things worth a look. Most take minutes to fix. |
| C | 50 and up | Mostly safe, a few things to check | Your site is mostly safe. A few things make common attacks easier, so check them when you can. Most take minutes to fix. |
| D | Below 50 | Gaps to fix first | Some open gaps make common attacks easier. Start with these. The fixes are usually small. |
A grade never reads better than the issues beside it. An open medium issue keeps your score at 84 or below, so it can't be an A. An open high issue keeps it at 69 or below. A leaked secret, or issues that combine into an attack, keep it at 49 or below. The report says when this happened and why.
If your site builds its pages in the browser, as most sites made with Lovable, Bolt or a React starter do, the score covers the settings your site sends to every visitor. Checks that need the finished page, like forms and cookies, are marked as not tested and never counted either way.
Things to fix
Each issue is a card with a severity and four answers. Severity uses one scale, Critical, High, Medium, Low or Info, and Pulse and Deep rate up to High.
- What it means, in plain words.
- What someone could do with it.
- How to fix it, with a prompt you can paste into your coding assistant.
- Who fixes this, for example you in your domain settings, your developer or your hosting provider, and roughly how long it takes.
Open the details to see the Evidence, Where we saw it and how confident we are. For issues in public records, See it for yourself links to the public record so you can check it without us.
A Pulse also reads your sitemap, the list of pages you give search engines. If it is missing, not named in your robots.txt, broken, or lists addresses or dates that search engines will not use, you get an Info card about search visibility. These cards are not security issues and never change your grade.
When there is nothing to fix, the list reads "No issues found in what we checked."
Plain words or Technical
Reports start in plain words. Switch to Technical to see the evidence, headers and sources, with OWASP, CWE, ASVS and WSTG references for your developer.
What we checked
Every report says what each part of the scan read, for example how many pages and scripts, and marks anything it could only sample or could not test. A part we could not check is never counted as a pass.
Share your score
You can create a public link to your result. It shows your score, your grade and the titles of what is worth fixing. The evidence and the fixes stay private. Choose Stop sharing at any time and the old link stops working.
Was this helpful?