Website Security Score: How to Check Yours in One Scan

Problem

You want a straight answer to a simple-sounding question: how secure is my domain, on a scale someone else can read? Plenty of tools will hand you a letter grade and a green checkmark. The grade is easy to get and easy to misread — so the useful skill isn’t getting a number, it’s knowing what the number is made of and which part to fix first.

What a Security Score Actually Is

A domain security score is a weighted triage signal, not a verdict. It rolls up a batch of externally observable checks — DNS, TLS, HTTP headers, email authentication, open ports — into one figure so you can tell “nothing obvious is broken” from “something load-bearing is missing” at a glance. That’s genuinely useful for prioritizing. It is not a certificate that you’re safe, because everything it measures lives on the outside of your system, and most real breaches come from the inside — a bug, a weak password, an unpatched library the scan can’t see.

So the number is a starting gun, not a finish line. The value is in the breakdown underneath it, which is where DechoNet’s Comprehensive Lookup actually points you.

What’s in the Number: The Nine Areas and Their Weight

DechoNet’s score runs from 0 to 100, and every area carries a fixed weight. This matters, because the weights tell you where a problem hurts most:

Area	Weight	What it checks
DNS	18	A/AAAA, CNAME, NS, MX records resolving correctly
SSL/TLS	18	Certificate validity, expiry, SAN coverage, chain
HTTP	14	Security headers, redirects, final response code
Email	14	SPF, DKIM, DMARC records and alignment
RDAP	10	Registration status, expiry, lock flags
Propagation	8	Consistency of DNS answers across resolvers
Port	8	Which ports are reachable from outside
Reverse DNS	5	PTR record presence and validity
ASN	5	Network/routing origin

DNS and TLS together are 36 of the 100 points — more than a third. That’s not arbitrary: if your name doesn’t resolve or your certificate is broken, nothing else about your site matters, so those two dominate the score by design. Fixing a header nicety while your certificate chain is incomplete is polishing the doorknob on a door that won’t open.

How a Critical Issue Actually Costs You

Each area doesn’t just pass or fail — it loses points by severity. A critical issue in an area burns 40% of that area’s weight; a warning burns 15%; informational findings cost nothing. Incomplete data costs about 10%. Losses are capped at the area’s full weight, so an area can zero out but never go negative.

Work an example. A critical SSL finding — say an expired certificate — costs 40% of 18, about 7 points, and drops you from a 95 to an 88 on that one issue alone. A critical in Reverse DNS costs 40% of 5, just 2 points. Same severity, very different bill. That asymmetry is the whole point of reading the breakdown instead of the headline: the scan is already telling you that the expired cert matters three times as much as the missing PTR record.

How to Check Yours

• Run Comprehensive Lookup on your domain. It fires DNS, SSL, HTTP, email, RDAP, propagation, port, reverse-DNS, and ASN checks in one pass and returns the 0–100 score, a per-area breakdown table, and a ranked list of priority actions. (The letter grade you see on the share card — A+ through F — is just that same score bucketed for a headline.)
• For any area the breakdown flags, open the dedicated tool to see the detail: SSL Check for certificate and chain problems, HTTP Check for missing security headers, DNS Lookup for record errors.

Raise Your Grade in the Right Order

The fastest way up is not “fix everything.” It’s weight times severity, highest first — exactly the order the priority-actions list already gives you.

1. Clear criticals in DNS and SSL first. They’re the heaviest areas (18 each) and a critical in either costs ~7 points. An expired or mismatched certificate, a domain that doesn’t resolve — these are both the biggest point swings and usually the fastest fixes.
2. Then HTTP and email criticals. At 14 each, a critical costs ~5.6 points. Missing HTTPS enforcement, or an email setup with no SPF/DMARC, land here.
3. Then warnings in the heavy areas before criticals in the light ones — a warning in SSL (~2.7 points) outweighs a critical in Reverse DNS (2 points). Let the math, not the alarm color, set your order.
4. Stop when the remaining items are informational. Chasing a 98 to a 100 is effort spent where the scan already says nothing is wrong.

What the Score Can’t See

Be honest with yourself about the ceiling. This score reads your domain the way an outside attacker’s first pass would — configuration visible without logging in. It cannot see your application code, your authentication, your patch level, your access controls, or what happens after a request reaches your server. A site can hold a clean A and still fall to an injection bug, a leaked API key, or a weak admin password. The score’s job is to catch the misconfigurations you can fix in an afternoon and rank them; the rest of security is still yours to do.

Resolution Checklist

• Run a Comprehensive Lookup and read the breakdown table, not just the number.
• Sort your fixes by the area’s weight times the finding’s severity — the priority-actions list already does this.
• Clear every critical in DNS and SSL before touching lighter areas.
• Re-run after each fix; confirm the point loss for that finding is gone.
• Treat any area marked “incomplete” as a measurement issue first — re-scan before assuming it’s broken.
• Once only informational items remain, stop optimizing the number and go audit the things the scan can’t see.

When to Escalate

• If an area stays critical after a fix and a re-scan, open its dedicated tool for the raw detail and hand that to whoever owns the service — a managed CDN, a mail provider, or your registrar may control the setting you can’t change.
• If the external score is clean but you’re chasing a real incident, escalate inward: logs, application code, and access controls are where the answer is, and no external scan will surface it.