what every block measures, and where your points went
Prepared for Paul Mansur and Julie Rodriguez
A score is the share of checks a block passed, weighted by how much each one matters.
Every rule carries one of three severities. An error is something actively costing you, like a page Google cannot index. A warning is a real miss that is not breaking anything today, like a missing description. An info is a best practice worth having. Errors move a score far more than info items do, which is why a block can fail a dozen info checks and still score well, and why failing two errors can sink one.
A block score is that block's rules only. Security is scored against the 15 security rules and nothing else. The overall 32 is the weighted average across all 18 blocks, so a block with 60 rules moves the total more than a block with 2.
Rules that do not apply are excluded, not failed. You have no e-commerce, so product schema is never counted against you.
Fifteen rules. You pass twelve. Three misses is what a 53 looks like.
The Adobe Fonts stylesheet carries no integrity hash. Adobe generates that file dynamically per request, so a fixed hash would break your fonts the next time they update the kit. This is the same finding SecurityScorecard raised. It clears permanently only by hosting the font yourself.
An optional header that declares which browser features the site is allowed to use, such as camera or microphone. Nothing is exposed by its absence. It is a one-line addition and it is included in the work below at no charge.
No bot challenge on the contact form. This is a spam exposure rather than a security hole, but it is worth adding before the search work starts sending more traffic at that form.
The twelve that pass: HTTPS on every page, HTTP upgraded to HTTPS before anything loads, HSTS with a two-year max-age and preload, a Content Security Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, no mixed content anywhere, every form posting over HTTPS, no credentials or environment variables exposed in the source, no third-party cookies beyond analytics, and clean cookie flags.
One warning sits alongside them: Sucuri and the application each set framing and policy headers, so two of some headers arrive. Harmless today, untidy, and already scheduled.
what 53 does not meanIt does not mean the site is insecure. Every check that describes an actual attack surface passes, including the ones most sites fail. Because the block holds only 15 rules, three optional misses move the number a long way. Two of the three take under an hour and are included.
Six are already at one hundred. The rest are the search layer.
Do not read the eighteen blocks as equals.
A small block swings hard. Internationalization has 2 rules, so one pass takes it to 100. Accessibility has roughly 60, so 80 there represents far more work than 100 somewhere else.
The overall 32 is a search readiness number, not a build quality number. It is dominated by the blocks that describe whether search engines can find, read and rank the site. Google's own Lighthouse test, which measures how well the site is actually built, returns 84 for performance and 96 for accessibility, ahead of all three competitors we scanned.
Scores move in steps, not smoothly. Because rules are pass or fail, a single fix applied sitewide can move a block twenty points at once. That is why the first ninety days move the number faster than any period after it.
the same scan, every timeSame rules, same pages, same weighting, whenever we re-run it. The day-ninety scan is this scan, which is the only honest way to measure whether the work did anything.