How VitalSite Calculates Your Website Security Score

Your VitalSite security score is a single number from 0 to 100 that summarizes the security posture of your entire domain. It starts at 100, then subtracts a weighted penalty for every issue found across all scanned pages.

The formula

The score starts at 100 and subtracts a weighted penalty per finding by severity — roughly 20 points for a critical, 10 for a high, 4 for a medium, and 1.5 for a low.

Crucially, penalties use diminishing returns within each severity: the first issue of a given severity costs the full weight, and each additional issue of the same severity costs progressively less. This stops a single systemic problem — like one header missing on every page of a large site — from unfairly collapsing your score to zero. The score floors at a small non-zero minimum, and passed checks simply avoid a penalty.

Why severity weighting

Not all findings are equal. An exposed .env file (critical) can hand an attacker your database today; a missing Permissions-Policy (low) is a hardening nicety. Weighting reflects real-world risk rather than counting issues equally.

What the bands mean

• 90–100 — Excellent: your domain is well protected.
• 70–89 — Fair: a few things need attention.
• 40–69 — Poor: several vulnerabilities found.
• 0–39 — Critical: immediate action required.

How to raise your score fastest

Fix critical findings first — each one is worth 20 points. The VitalSite report sorts your top three highest-impact actions to the top so you always know where to start.