Results lead with risks in plain English (for example "2 high risks: scammers can send emails pretending to be you"). The tidiness score out of 100 comes second. Even large companies rarely score 100. What matters is fixing the high risks.
The model is weighted towards the things that cause real harm to UK small businesses: email impersonation (fake invoices, phishing in your name) and a broken website padlock.
| Priority | Penalty if failed | Checks |
|---|---|---|
| High | -25 | Sending domain: SPF missing; DMARC missing or p=none (monitoring only). Non-sending domain not locked down: SPF or DMARC missing, or DMARC p=none. Website certificate expired, invalid or expiring in under 14 days. No working HTTPS. |
| Medium | -10 | Certificate expiring in 14 to 29 days; weak SPF (no -all/~all, or several SPF records); non-sending SPF that still allows senders; HTTP not redirected to HTTPS; HSTS missing; outdated TLS version; TLS 1.0/1.1 still accepted. |
| Low | -4 | DKIM not found at common selectors; non-sending domain without null MX; DMARC p=quarantine on a non-sending domain; X-Content-Type-Options missing; software version numbers disclosed. |
| Optional (light) | -2 | Content-Security-Policy, Permissions-Policy, Referrer-Policy and X-Frame-Options headers; DNSSEC. Worth having, but rarely the cause of harm to a small business. |
Checks we couldn't test (for example when plain HTTP is unreachable from our scanner) are ignored, never penalised.
So a domain can only score 70+ when there are no High risks.
High risks are counted and described in plain English. Similar risks share one phrase: SPF and DMARC both read "scammers can send emails pretending to be you". With no High risks, the headline lists Medium risks. With none of either, it says so.
| Headline phrase | Checks |
|---|---|
| scammers can send emails pretending to be you | SPF, DMARC |
| visitors may see a security warning instead of your website | certificate, HTTPS |
| Domain | Old model | New model | Headline |
|---|---|---|---|
| kirbytech.co.uk | 60 | 65 | 1 high risk: scammers can send emails pretending to be you |
| kirbysbpm.co.uk | 58 | 44 | 2 high risks: scammers can send emails pretending to be you |
| a large UK retailer's domain | 86 | 94 | No high or medium risks found |
The old model averaged weights over every check, including passed ones. Missing optional headers dragged good domains down, while a parked domain with no email protection could still score close to 60.
Code: scanner.py (PENALTY, LIGHT, CAP_ONE_HIGH, CAP_TWO_HIGH, score(), risk_summary()).