Methodology: how WebMeter calculates the website score and A–F grade

What we measure and where the data comes from

WebMeter assesses a website in 15 areas. All but two have their own score from 0 to 100: Cyber hygiene (NIS2) and Third parties are overviews without a score. The question each area answers is listed on the What we check page. The three steps of a check are described on the How it works page.

The measurement uses publicly available information only:

• The website itself. The robots.txt file, the home page and its HTTP headers, up to 30 further public pages from the menu and the sitemap, up to 8 JavaScript files loaded by the home page, and files such as sitemap.xml or security.txt. In addition, a TLS connection to read the certificate and the supported TLS versions.
• A browser. Chromium renders the home page once, on a server in the EU with Czech settings (language cs-CZ, time zone Europe/Prague). It never clicks the cookie banner. The axe-core accessibility test runs in the rendered page against WCAG 2.2, levels A and AA.
• DNS. The domain's public records: SPF, DMARC, common DKIM selectors, MX, MTA-STS, DANE, BIMI, CAA, DNSSEC, name servers and IPv6. Queries go through Google's DNS over HTTPS. A second resolver from Cloudflare confirms broken DNSSEC. Similar-looking domains are also checked with DNS queries.
• Google PageSpeed Insights. Mobile speed from three Lighthouse lab runs. Google loads the website from its own infrastructure.
• Public registries and services. The domain registry's RDAP (registration expiry), the public certificate logs crt.sh and, as a fallback, Cert Spotter (subdomains), RIPEstat (RPKI), ARES, the Czech business register (to verify a Czech company ID shown on the site), the HSTS preload list, and the revocation status of the certificate at its issuer.
• Tables stored in the application. End-of-support dates for software, the status of WordPress versions and the CISA KEV catalogue of exploited vulnerabilities. These are snapshots and are not downloaded during a check.

WebMeter does not log in, does not try passwords or vulnerabilities and does not fill in forms. How it behaves on your website is described on the WebMeterBot crawler page.

The report also shows indicative grades based on the public methodologies of SSL Labs and Mozilla HTTP Observatory. These are not official results of those services and do not count towards the score.

How an area score is calculated

Every area starts at 100 points. Each finding deducts points according to its severity:

From the fourth finding of the same severity in one area, only half is deducted. A string of minor issues therefore does not push an area down to zero. An area score never drops below 0. The model is based on the Mozilla HTTP Observatory methodology.

Example: two medium findings and one low finding give 100 − 8 − 8 − 3 = 81 points. Five medium findings give 100 − 3 × 8 − 2 × 4 = 68 points.

SEO: the sum of six pillars

The SEO area is calculated differently. Its score is the sum of six pillars: indexing 25 points, titles and descriptions 25, content and structure 15, structured data 15, sharing 10 and technical basics 10. Points are awarded according to the share of assessed content pages. SEO findings explain what is missing but do not deduct points. Details are in the SEO checker guide.

Speed: lab data only

The speed score is based on the median of three Lighthouse lab runs on mobile. It looks at LCP, TBT (the lab substitute for INP), CLS and server response, among others. Data from real visitors (CrUX) is shown separately in the report and does not enter the score. This way, websites for which Google has no such data are measured in the same way.

Overall score and A–F grade

The overall score is a weighted average of the area scores. The weights add up to 100:

The report assesses the informative areas and shows their scores. They do not enter the overall score.

Worked example (simplified, fictitious website)

An area's contribution is score × weight / 100. If the website's certificate expired (a critical finding, −40 points in HTTPS and certificate), the weighted average would drop to 75.74. The cap for a critical finding then lowers it to 74, i.e. grade C.

The score determines the grade and the colour:

There is no grade E. The score is shown as a whole number rounded down, so that it always matches the grade: 89.6 points is shown as 89 with grade B.

The sample report shows how the score, grade and caps look in a finished report.

Caps: when a score cannot be high

Some findings are so serious that an average would hide them. That is why caps apply. A cap can only lower a score, never raise it. When several caps apply at once, the lowest one counts. The report states the reason next to a capped area.

• A critical finding in any area: the overall score is at most 74, so at best grade C and yellow. Critical findings include a website excluded from search engine indexes, an expired, untrusted or revoked certificate, a server offering only the outdated TLS 1.0 or 1.1, a domain whose registration has expired, a domain with neither SPF nor DMARC, and a live secret key for a payment or cloud service in the website's code.
• CMS and technology: software that probably no longer receives security updates limits the area to 59 points at high or critical severity and to 74 points at medium severity.
• SPF, DKIM, DMARC: if DMARC is missing, published twice or not applied, the area has at most 74 points.
• Security headers: if HSTS, an effective CSP and protection against framing are all missing, the area has at most 39 points.
• SEO: a home page excluded from the index (noindex, a block for Googlebot or SeznamBot in robots.txt, a canonical pointing to another domain) means at most 20 points. If titles and descriptions are missing or repeated on half or more of the content pages, the cap is 59 points; if only titles or only descriptions are affected, it is 74 points. These two caps apply only from three assessed content pages.
• AI search and Search engines beyond Google: a finding of high or critical severity limits the area to 74 points. This does not affect the overall score, because these areas are informative.

When something cannot be measured

Occasionally an area does not run, for example when PageSpeed Insights does not respond. A missing area is not dropped from the average, as that could raise the score artificially. It counts as 50 points, or as the average of the measured areas if that is lower.

An area measured only in part, for example speed from a single run, carries half its weight. The rest of its weight counts as unmeasured. The exception is an outage of an optional third-party service, such as the certificate logs. No data about the website is missing in that case, so the outage does not move the score and the report simply mentions it.

If not everything was measured, the grade is provisional. The report then shows the range of grades the score could fall into if the unmeasured part came out at 0 or at 100 points. It also shows the coverage, meaning the share of the weight that was measured. From 90% confidence in the result is full, from 70% it is reduced, below 70% it is low.

What finding severity means

Severity is set by fixed rules for each type of finding. The same state of a website always gives the same severity. The report lists findings from the most severe.

• Critical: a serious defect affecting the whole website, the domain or email. For example, a website that search engines are not allowed to show, or a certificate that browsers do not trust. Deducts 40 points, and the overall score is also capped at 74.
• High: a weakness that may allow misuse of the website or email, or that significantly harms visitors or search visibility. Deducts 20 points.
• Medium: a weakness worth fixing in the near future. Deducts 8 points.
• Low: a minor issue or a deviation from recommended practice. Deducts 3 points.
• Info: information with no effect on the score. Context, a state that cannot be verified from outside, or an optional standard.

When a finding rests only on indirect evidence, such as an estimated software version, its severity is deliberately lower. Risks in the report are possible consequences of the observed state, not a confirmed incident.

What the measurement cannot do

• It is not a penetration test. An outside check does not reveal flaws inside the application, weak passwords or the state of the server. A good score is therefore no proof of security or of legal compliance.
• It does not measure search rankings or PageRank. Nor does it see backlinks or traffic. Your actual rankings are shown in Google Search Console or Seznam Webmaster.
• It does not see content behind a login. Nor admin areas, customer accounts or paths that robots.txt disallows.
• It does not see what the website loads after cookie consent. The browser never clicks the banner. It assesses what a visitor sees before making any choice.
• Speed is measured in a lab. Lighthouse simulates a mobile device on a throttled connection. Real visitors may have a better or worse experience. Google has CrUX data only for websites with enough traffic.
• It does not crawl the whole website. It measures the home page and a sample of further public pages.
• Some data is an estimate. The software version is estimated from public traces. WebMeter may not find DKIM with an unusual selector, so it marks it as unverified rather than missing.
• An automated accessibility test covers only part of WCAG. It does not prove that a website is accessible.
• It is not a legal opinion. For cookies and company details it shows what is visible from outside. It does not assess legal compliance.
• It is a snapshot. The result applies to the moment of measurement.

Independence and methodology version

• WebMeter is free, without registration and without ads.
• The score is calculated by software according to the rules on this page, in the same way for every website. The same data gives the same score. No manual assessment enters the calculation.
• The report contains no advertising and no offer of services. Depending on the result, a link to the operator's services may appear below the result on the website. It has no effect on the score.
• The report assesses. For each finding it briefly states what it concerns and who usually deals with it. It contains no ready-made code, configuration or step-by-step instructions.
• In a competitor comparison, all websites are measured with the same methodology and only scores from the same major version are compared.

Methodology version

The current version is 3.0.0 (Measurement 3.0, October 2026). Every report states the version it was created with. A change in the calculation gets a new version number, and we describe it on this page. Scores from versions 2.x and 3.x are not compared directly.

• 3.0.0 (October 2026): SEO is calculated from six pillars, area caps were added and the severity of a number of findings was refined. Area weights, points per severity and grade boundaries did not change.

Frequently asked questions about the score calculation

Who is behind WebMeter

WebMeter is a service of ON Consulting & Advisory. The operator designs and maintains the methodology. It builds on public standards and documentation, for example RFC 9309 for robots.txt, RFC 7208 for SPF, WCAG 2.2, Google's Core Web Vitals thresholds and search engine documentation. The deduction model follows Mozilla HTTP Observatory scoring, the indicative SSL Labs grade follows their SSL Server Rating Guide, and the table of exploited vulnerabilities comes from the CISA KEV catalogue.

Details about the operator are in the privacy policy. Please send questions about the methodology or reports of a measurement error to kontakt@webmeter.eu.