Method
How the Qawex Score works
Every scan starts at 100. Each problem we find takes off a fixed number of points. Checks we can't run never change your score.
What we check
Two pillars are live today: Security and Speed. For Security, we look at HTTPS, security headers, cookie flags and email protection (SPF, DMARC, MX and common DKIM selectors). We also note security.txt and any software version your server shows. Those two are information only and never lower the grade.
| Problem found | Points off |
|---|---|
| Site doesn't load over HTTPS | −40 |
| http:// doesn't redirect to https:// | −10 |
| No Strict-Transport-Security header | −8 |
| No Content-Security-Policy header | −8 |
| No X-Content-Type-Options header | −4 |
| No X-Frame-Options or CSP frame-ancestors | −6 |
| No Referrer-Policy header | −3 |
| No Permissions-Policy header | −2 |
| Cookies missing Secure, HttpOnly or SameSite | −5 |
| No SPF record | −8 |
| SPF doesn't end in -all or ~all | −3 |
| No DMARC record | −10 |
| DMARC policy is "none" | −5 |
DKIM is only reported when we find it. If we can't see it from outside, we say so and never count it as missing.
Security grade bands
- A90–100
- B80–89
- C70–79
- D60–69
- F0–59
Speed
We ask Google PageSpeed Insights to test your homepage on a mid-range phone with a mobile connection. Your Speed grade comes straight from Google's performance score (0 to 100). We also show these measurements, which don't change the grade on their own:
- Largest Contentful Paint: good up to 2.5 s, poor over 4 s.
- Layout shift: good up to 0.1, poor over 0.25.
- Interaction to Next Paint (from real Chrome visitors, when Google has enough data): good up to 200 ms, poor over 500 ms.
- Page weight: good up to 1.6 MB, heavy over 3.0 MB.
- The three opportunities that could save the most time.
If Google doesn't answer within 60 seconds, we show "could not check" and give no grade.
- A90–100
- B75–89
- C60–74
- D50–59
- F0–49
What we never do
- No logins, and no guessing passwords.
- No port scans.
- No attacks, tests that try to break things, or form submissions.
- We only do what a browser visit and a DNS lookup do: one page request over https, one over http, up to 3 redirects, and public DNS records.
Ask us not to scan your site
Contact us at qawexsolutions.com/contact with your domain and we'll add it to our do-not-scan list.
What we store and for how long
- The domain, the findings and the score. Anonymous scans are deleted after 90 days.
- For rate limits, a scrambled (hashed) version of your IP address, deleted after 24 hours. We never store the raw IP.
- Your email, only if you ask us to send a report and agree to it.
Our scanner's User-Agent
Requests from our scanner identify themselves as:
QawexScan/1.0 (+https://qawex.com/audit/method)