A letter grade is useful only when you know what sits behind it. The Cyber Craft Scorecard gives you a first look at six public website and email checks, so you can decide what needs a closer look.

How the score works

The six checks have 85 possible points in total. When all six can be confirmed, the grade uses the percentage of those points: A at 90% or more, B at 75%, C at 60%, D at 40%, and F below 40%.

If any check is unconfirmed, the overall grade is withheld. An unconfirmed result means the tool could not establish the answer; it does not prove a protection is missing.

What the six checks look at

  1. HTTPS reachability: 20 points. Whether the checking service can reach the website over HTTPS. This is a limited connection check, not a complete certificate or application audit.
  2. HTTP-to-HTTPS redirect: 10 points. Whether the HTTP address redirects to HTTPS.
  3. SPF: 10 points. A public email policy describing authorized sending services.
  4. DMARC: 15 points. A published policy for handling email that fails domain authentication checks.
  5. DKIM: 10 points. Public signing records found through a limited set of common selectors. A selector the tool does not discover may still exist.
  6. Security headers: 20 points. Five header signals, with up to four points each. The check does not establish that a policy is suitable for every page or that it is effective against a particular attack.

Read the finding before choosing a fix

Each result shows what was observed, what needs review, what was partial or what could not be confirmed. Read the details and relate them to the services your business actually uses.

For email records, use the domain after the @ in your business email address. A website subdomain and the domain used to send email may have different records.

Before changing email policies, check all legitimate sending services with your provider or administrator. Website headers also need to fit the site. A change that sounds sensible in isolation can interrupt working services.

What the score does not tell you

No malware or blacklist lookup is performed. A high grade does not prove a website is trustworthy, its applications are secure or its email cannot be spoofed. The score is a limited set of public signals, not a penetration test or compliance assessment.

Keep a useful record

Download the text report to keep the findings and check time together. Use it to discuss the result, confirm the evidence and decide which follow-up belongs first.

Check your domain → · Talk through what you found ↗

Related reading