A school report card for your website: security headers, e-mail protection and certificate, graded like at school

Try it first: type a domain into the report card, wait a few seconds, and you get a school report for that website. There is a demo button with my own site, which gets an A.

What is graded

• Security headers (40 %): HSTS, Content-Security-Policy, nosniff, frame protection, Referrer-Policy, Permissions-Policy, COOP and whether the server gives away its version. Same scoring as the header checker.
• E-mail protection (35 %): SPF and how it ends (-all or ~all), DMARC and its policy (reject, quarantine or none), DMARC reports and MTA-STS. This decides how easily someone can send forged mail in your domain's name.
• TLS certificate (25 %): valid, trusted, matching the name, days left and the protocol version.

The overall score becomes a grade: A to F in English, 1 to 6 in the German version, marks out of ten in the Italian one. A to C passes, D is at risk, F repeats the year.

The teacher remarks

Below the grades the class teacher adds two to four remarks, picked from the weakest points: "Content-Security-Policy is missing. Homework due next week." or "DMARC at p=none: watches carefully, never steps in." They are funny, but every one of them points at a real finding, and each subject links to the detailed tool that shows how to fix it.

Built to be shared

Every report card gets its own link. When you share it on WhatsApp, LinkedIn or Telegram, the preview shows the card itself, with the grades and the red circle around the overall grade, because messengers do not run JavaScript and get a server-rendered image instead. The idea: you check your site, post your grade, and a colleague checks theirs.

How it works

One PHP endpoint runs the three existing checks of this site in a single request, turns their results into grades, writes the remarks in three languages and draws the share image with GD. Nothing else is stored, the checks only read public information (HTTP headers, DNS records, the certificate), and each visitor can request ten report cards per hour.

If you want to compare with well-known sites, the header ranking and the e-mail ranking show the same checks for about 100 domains.

Originally published at daniele-michelin.com. More guides, free checks (SPF, TLS, headers) and an error-message lexicon: daniele-michelin.com/en/.