Website Security Test Scoring Methodology
https://www.immuniweb.com/websec/scoring
Scoring Methodology
- At the beginning of the test, the score is set to 100
- Points are added for good and reliable configuration of your website and web server
- Points are deducted for insecure, incomplete or unreliable configuration of your website or web server
- Total points for all detected CMS(s) and CMS components will not go below -50 or above +50
- Total points for all detected JS components will not go below -20 or above +20
- Total points for all HTTP methods and CSP will not go below -30 or above +30
- Total points for all cookies will not go below -10 or above +10
- No website may score above “C” if a vulnerable software is found
- No website may score above “B+” if CMS is not up2date
- No website may score below “C” if its CMS and CMS components have no known vulnerabilities
- The score is set to 0 if the website is loading scripts suspected malware or other malicious activities
- The score is set to 0 if the website is loading content from domains suspected in malware distribution or other malicious activities
- Server gets an “N” if a tested port is closed or HTTP status code is not 200, 301, 302, 303, 307 or 308
| Grade | Score |
|---|---|
| A+ | Score greater than 100 |
| A | Score between 90 and 99 |
| A- | Score between 80 and 89 |
| Grade | Score |
|---|---|
| B+ | Score between 70 and 79 |
| B | Score between 60 and 69 |
| B- | Score between 50 and 59 |
| Grade | Score |
|---|---|
| C+ | Score between 35 and 49 |
| C | Score between 20 and 34 |
| F | Score lower than 20 |
Website Security and Compliance
| Description | Score |
| WAF is present | +20 |
| WAF is missing | -5 |
| CMS is up2date | +20 |
| CMS is not up2date | -15 |
| CMS is not up2date and is vulnerable | -50 |
| CMS component is up2date | +15 |
| CMS component is not up2date | -10 |
| CMS component is not up2date and is vulnerable | -30 |
| JS component is up2date | +10 |
| JS component is not up2date | -5 |
| JS component is not up2date and is vulnerable | -30 |
| Server supports Custom HTTP methods | -10 |
| Server supports TRACE, TRACK or CONNECT HTTP method | -10 |
| A cookie does not have the HttpOnly flag set | -5 |
| A cookie has the Secure flag set | +5 |
| A cookie has the SameSite flag set to Lax | +5 |
| A cookie has the SameSite flag set to Strict | +5 |
| A cookie does not have the SameSite flag set | -1 |
| A cookie name has the “__Secure-” prefix and its prerequisites | +5 |
| A cookie name has the “__Host-” prefix and its prerequisites | +5 |
| Web server directory listing enabled | -10 |
| The website is using resources from third-party domains that cannot be resolved | -30 |
HTTP Security Headers and Content Security Policy Scoring
| Header Name | Description | Over HTTP | Over HTTPS |
| Permissions-Policy | Header is present and valid | +15 | +15 |
| Permissions-Policy | Header is present and wrongly configured | -10 | -10 |
| Access-Control-Allow-Origin | Header is present and valid | +5 | +5 |
| Strict-Transport-Security | Header is present, valid and enforced | 0 | +25 |
| Strict-Transport-Security | Header is missing | 0 | -20 |
| Strict-Transport-Security | Header has a duration below 6 months | 0 | -10 |
| Strict-Transport-Security | Server certificate is untrusted | 0 | -1 |
| X-Frame-Options | Header is present and valid | +15 | +15 |
| X-Frame-Options | Header value is ALLOWALL | -10 | -10 |
| X-Content-Type-Options | Header is present and valid | +15 | +15 |
| X-Content-Type-Options | Header is missing | -10 | -10 |
| X-XSS-Protection | Header is deprecated and present | -10 | -10 |
| Content-Security-Policy | Header is present | +20 | +20 |
| Content-Security-Policy | Header is missing | -20 | -20 |
| Content-Security-Policy | Header has default-src set to ‘none’ or ‘self’ | +5 | +5 |
| Content-Security-Policy | Header contains wildcard in default-src directive | -10 | -10 |
| Content-Security-Policy | Header contains wildcard in any other directive | -10 | -10 |
| Content-Security-Policy | Header has frame-ancestors directive set and restricting sources and X-Frame-Options header is not set | +10 | +10 |
| Content-Security-Policy | Header has frame-ancestors directive set with wildcard and X-Frame-Options header is not set | +5 | +5 |
| Content-Security-Policy | Header has frame-ancestors directive set and consistent with X-Frame-Options header value | +5 | +5 |
| Content-Security-Policy | Header has frame-ancestors directive set and inconsistent with X-Frame-Options header value | -5 | -5 |
| Content-Security-Policy | Header enables XSS blocking | +15 | +15 |
| Content-Security-Policy | Header enables XSS filtering | +15 | +15 |
| Content-Security-Policy | Header has the reflected-xss directive set | +5 | +5 |
| Content-Security-Policy | Header has the upgrade-insecure-requests or the block-all-mixed-content directive set | +5 | +5 |
| Server | Header discloses server’s software version | -5 | -5 |
| X-Powered-By | Header discloses server’s software version | -5 | -5 |
| X-AspNet-Version | Header discloses server’s software version | -5 | -5 |
Website
Privacy Test
Cloud
Security Test
Email
Security Test
Mobile App
Security Test
Dark Web
Exposure Test
SSL
Security Test
