How to Read Your Website Trust Score

The score is a sum of points earned across four categories: Security (worth 40 of the 100 points), Infrastructure (20), Domain (20), and Reputation (20). Each category is made up of individual checks — the same HTTPS, TLS, and security-header checks described in detail on our features page, plus a few infrastructure and domain signals collected alongside them.

Every check earns points independently: a full-weight check that passes earns all of its points, a warning earns roughly half, and a failed or not-checked item earns none. The checks aren't weighted equally — for example, whether HTTPS is enforced counts for more of the Security category than whether a Referrer-Policy header is set, because a missing HTTPS redirect is a more consequential gap than a missing referrer header. Your overall score is simply those points added up.

Strong — 80–100

A Strong score means the scan found a relatively strong set of the checks Nyrolo evaluates — most of the HTTPS, header, infrastructure, and domain signals came back clean. It does not mean the site has been proven completely secure; it means it held up well against the specific things this scan actually checks.

Needs work — 50–79

A score in this range means the scan found real issues worth reviewing and fixing — typically a mix of passing and failing checks. Two sites can both land at, say, 65 for very different reasons: one might be missing a couple of security headers, another might have a weaker TLS setup. The category breakdown and individual check results (not just the number) tell you which.

At risk — below 50

This range means the scan identified substantial weaknesses among the checks Nyrolo evaluates — several checks failing, not just one. It's a signal that the site's owner should review the findings and prioritize fixes, not a claim that the site has been actively compromised or is currently under attack.

Two things surprise people most often. First, checks aren't weighted equally — missing one heavily-weighted check (like HTTPS enforcement or a valid TLS certificate) costs more than missing several lightly-weighted ones, so the number doesn't move in even steps per issue.

Second, the Reputation category (worth 20 of the 100 points) is scored separately from the technical checks, using an external threat-intelligence provider. When no reputation provider is configured for a scan, that category is marked Not checked and contributes zero points — not because anything is wrong, but because nothing was actually verified there. That means a site can pass every single technical check it's possible to pass and still cap out at 80 points (exactly the Strong threshold) until reputation is verified too. A lower-than-expected score is worth a look at the category breakdown before assuming something is broken — it may just be an unverified category, not a failed one.

Every check lands in one of four states: Pass, Warning, Fail, or Not checked. A pass earns full points; a warning (for example, HSTS present but with a short max-age) earns partial points — the underlying protection exists but isn't configured as strongly as it could be; a fail earns none; and not-checked also earns none, but specifically means the information wasn't available rather than that something was confirmed broken.

Your scan result page shows every check individually, grouped by category, each with a plain-English explanation of what it means and — for anything short of a pass — a specific recommendation for what to change. Reading that list is usually more useful than the single number alone, since it tells you exactly which things to fix and, indirectly, how much fixing each one would move your score.

A single failed or warning check is one data point, not a verdict. A site missing a Content-Security-Policy but enforcing HTTPS, using a valid certificate, and setting every other header correctly is in a meaningfully different position than a site failing several checks at once — even though both technically have "a failed check." That's exactly why the category breakdown and per-check detail exist: to let you weigh how serious a given gap actually is, rather than treating every failure as equally alarming.

It's also worth remembering that Reputation is a genuinely separate signal from the technical checks — passing every HTTPS and header check doesn't mean a domain's reputation is clean, and a clean reputation doesn't make up for missing security headers. They measure different things, and your result page shows them separately for exactly that reason.

A Nyrolo trust score is not:

• A guarantee that a website is completely secure
• A penetration test
• A complete vulnerability assessment of the site's code or infrastructure
• A guarantee against malware
• A guarantee against account compromise
• A replacement for professional security testing

It's an externally observable read on the specific HTTPS, TLS, header, infrastructure, domain, and reputation signals described above — a useful baseline, not a certification. For the same reason, it doesn't cover application-level vulnerabilities, authentication and authorization logic, dependency security, or backend infrastructure — see our website security checklist for more on what this kind of external check can and can't tell you, particularly if you're reviewing a site before launch rather than after a scan.

1. Start with the overall score and classification for a quick read.
2. Open the category breakdown to see which of the four areas is pulling the score down.
3. Read the individual check explanations and recommendations in that category.
4. Prioritize the highest-weighted or highest-severity issues first, not just the longest list.
5. Make the relevant configuration change on your server or hosting platform.
6. Re-scan the site and compare the new result against the old one.