A SecurityScorecard score is an outside-in safety grade assigned to your group primarily based solely on what’s publicly seen from the web. It doesn’t require your cooperation, your credentials, and even your consciousness. SecurityScorecard scans your public-facing infrastructure and scores what it finds — the identical means an attacker would take a look at your web site earlier than deciding whether or not to probe additional.
For those who’ve acquired a scorecard from a consumer, a vendor, or your individual safety group and aren’t certain what it means, this text explains what the platform measures, why sure points are troublesome to repair on shared or managed internet hosting, and what modifications with a devoted server.
How Does SecurityScorecard Measure Your Safety?
SecurityScorecard scans all the IPv4 tackle area — greater than 3.9 billion routable IP addresses — each 10 days throughout greater than 1,400 ports. The platform additionally scans cloud property a number of instances day by day as a result of cloud IP possession modifications incessantly.
The scan collects all the pieces an attacker would observe from the skin: uncovered ports, outdated software program variations, and identified vulnerabilities, together with knowledge from personal sources equivalent to risk intelligence feeds and vulnerability databases.
Nothing about this course of requires entry to your programs. Your rating displays what SecurityScorecard can see from the general public web — which can be what anybody attempting to compromise your web site would see first.
Scores replace day by day. In case your infrastructure and situation counts stay steady, your rating holds regular. For those who remediate a discovering, your rating improves, typically inside 24 to 48 hours after the subsequent scan cycle confirms the repair.
What Does the Letter Grade Really Imply?
The letter grade — A by F — and the corresponding numeric rating from 100 to 0 replicate the statistical probability that your group will expertise a breach. The decrease the rating, the upper the probability.
The connection between grade and breach chance is critical:
- A (90–100): Lowest breach probability
- B (80–89): Low threat
- C (70–79): Reasonable threat
- D (60–69): Elevated threat
- F (under 60): Excessive threat
Organizations with an F grade are 13.8 instances extra more likely to expertise a breach than these with an A. That’s not a marginal distinction. A D-rated group sits one grade above that threshold, and a scheduled scoring recalibration can transfer the needle additional in both route.
What Are the ten Danger Elements SecurityScorecard Evaluates?
SecurityScorecard charges corporations throughout 10 threat elements: software safety, cubit rating, DNS well being, endpoint safety, hacker chatter, leaked credentials, IP status, community safety, patching cadence, and social engineering.
A number of of those are instantly related to how your server is configured:
Community Safety checks for insecure open ports, weak TLS protocols, and misconfigured cipher suites. Insecure ports could be exploited to permit an attacker to avoid the login course of or acquire elevated entry to a system. If misconfigured, an open port acts as a direct entry level between a hacker’s setting and your inside community.
Utility Safety evaluates whether or not your internet properties implement HTTP safety headers — controls like Content material Safety Coverage (CSP), HTTP Strict Transport Safety (HSTS), and X-Content material-Kind-Choices that browsers use to dam widespread assault vectors.
Patching Cadence measures how rapidly your group responds to identified vulnerabilities and applies patches, in comparison with friends of comparable measurement. Sluggish patching is among the most constantly penalized behaviors on the platform.
DNS Well being validates that DNS configuration is clear, that mail servers have correct spoofing protections (SPF, DKIM, DMARC), and that no malicious occasions seem in your passive DNS historical past.
The remaining elements — IP status, endpoint safety, hacker chatter, leaked credentials — replicate issues like whether or not your IPs have appeared in malware feeds, whether or not credentials out of your group have proven up in breach knowledge, and whether or not your group is mentioned in risk actor communities.
Why Do Enterprise Shoppers and Procurement Groups Care About Your Rating?
A SecurityScorecard score has moved effectively past inside safety use. The platform’s patented expertise is utilized by organizations for enterprise threat administration, third-party threat administration, board reporting, due diligence, cyber insurance coverage underwriting, and regulatory oversight.
Meaning your rating is more and more seen to events exterior your group:
- Enterprise shoppers working vendor threat applications verify provider scorecards earlier than signing contracts. Some set minimal rating thresholds that distributors should meet to be accredited.
- Cyber insurers use SecurityScorecard rankings when pricing insurance policies. The platform has already delivered industry-first cyber insurance coverage reductions tied on to high safety rankings by insurer partnerships. A low rating can enhance your premium or restrict your protection choices.
- Procurement groups at regulated corporations — finance, healthcare, authorities contractors — are sometimes required to doc the safety posture of each vendor earlier than approving them. An F or D scorecard is a documented purple flag in that course of.
That surprises a whole lot of web site house owners. Most assume a safety score is an inside compliance metric. For companies and companies that promote to enterprise shoppers, it capabilities extra like a credit score rating — seen to counterparties and able to affecting offers earlier than a dialog ever begins.
Which Points on Your Scorecard Are Internet hosting Configuration Issues?
Most of the findings that seem on a SecurityScorecard report usually are not software program bugs or credential leaks. They’re server configuration points — issues that exist or don’t exist primarily based on selections made on the infrastructure degree.
Take into account what seems most incessantly on low-scoring websites:
TLS Protocol Assist: A server that also accepts connections over TLS 1.0 or TLS 1.1 is flagged as a high-severity community safety situation. These protocols had been deprecated by the IETF in 2021 due to identified cryptographic weaknesses. Whether or not these protocols are enabled or disabled is managed in your internet server configuration — Apache, NGINX, and Linux OS — not in your software code.
Cipher Suite Choice: Weak cipher suites — these utilizing RC4, 3DES, or export-grade encryption — are individually flagged. Which cipher suites your server advertises is ready in the identical internet server config information. An software working on WordPress or Magento has no management over this; the server controls it.
HTTP Safety Headers: CSP, HSTS, X-Content material-Kind-Choices, X-Body-Choices — these are headers that servers ship to browsers to limit what the browser is allowed to do with content material out of your area. Including them requires both a directive in your internet server configuration or middleware on the server degree. They can’t be reliably set from inside WordPress or a CMS plugin alone, and a CDN could override or strip headers relying on its configuration.
Certificates Configuration: Certificates lifetime, revocation help, and signature algorithm are properties of how a TLS certificates is issued and configured on the server. These usually are not points inside your software; they’re points with how the certificates is deployed.
Why Shared and Restrictive Internet hosting Environments Restrict What You Can Repair
That is the place internet hosting selection turns into a safety query, not only a efficiency or worth query.
On shared internet hosting — together with restrictive managed WordPress platforms — the server is configured and maintained by the internet hosting supplier. That’s the tradeoff: you don’t must handle the server, however you can also’t configure it. The online server that serves your web site is shared with dozens or tons of of different prospects, and its configuration displays the supplier’s decisions, not yours.
In case your internet hosting supplier hasn’t disabled TLS 1.0 throughout the platform, your web site will proceed promoting TLS 1.0 help. If HSTS isn’t configured on the server degree, your web site gained’t ship HSTS headers even in order for you it to. And since that configuration serves 1000’s of web sites, suppliers are sluggish to vary it — any misconfiguration impacts each buyer.
Managed WordPress hosts particularly optimize for WordPress efficiency and uptime. Server-level safety hardening is often not a part of what they promote. While you ask them to switch cipher suites or add world safety headers, the reply is usually both “we are able to’t do this” or “submit a help ticket and we’ll evaluation it” — with no timeline and no assure.
This creates a predictable state of affairs: findings seem in your SecurityScorecard report, you look into fixing them, and also you uncover the repair requires server entry you don’t have.
What Modifications with a Devoted Server
A devoted server provides you root entry to a bodily machine that nobody else shares. Each configuration determination — which TLS variations the server accepts, which cipher suites it advertises, which HTTP headers it sends, how certificates are managed — is yours to make.
Meaning each situation within the Community Safety and Utility Safety classes of a SecurityScorecard report turns into actionable. Disabling TLS 1.0 and 1.1 on an Apache server takes a single configuration change and a service reload. Including HSTS to each response is three strains in a server block. Implementing a strict Content material Safety Coverage requires entry to the identical configuration file. None of those require a help ticket. None require ready for a supplier to behave.
On InMotion Internet hosting’s Devoted Servers, you’ve gotten full root entry and full cPanel/WHM management. For purchasers preferring a guided strategy, InMotion Options — the in-house sysadmin group — can implement server-level hardening, deal with TLS configuration, and validate modifications in opposition to safety scoring standards. The Premier Care Bundle provides proactive safety administration with Monarx malware protection and Superior Product Assist.
The sensible final result: configuration-related SecurityScorecard findings which are unfixable on shared internet hosting turn out to be achievable on a devoted server.
What SecurityScorecard Does Not Measure
Just a few clarifications value making, as a result of the platform is usually overstated in what it covers.
SecurityScorecard measures your exterior assault floor — what’s seen from the general public web. It doesn’t consider your inside community safety, your entry controls, your worker coaching, or your incident response procedures. An ideal SecurityScorecard rating doesn’t imply your group has no safety vulnerabilities; it means your publicly-facing infrastructure doesn’t exhibit the alerts the platform checks.
The platform additionally has identified limitations round IP attribution. IP attribution points are cited as widespread scanning issues, and a few customers report misflagged IPs requiring help intervention. If findings seem that don’t match your infrastructure, SecurityScorecard supplies a dispute course of for reviewing and contesting misattributions.
Scores additionally replicate your peer setting. SecurityScorecard applies a logarithmic scale and calibrates scores in opposition to greater than 12 million organizations, evaluating your situation quantity to others of comparable measurement and digital footprint. A small enterprise and an enterprise don’t compete on uncooked discovering counts.
Find out how to Begin Bettering Your Rating
For those who’re a scorecard with a number of open points, probably the most sensible path is to work from highest to lowest breach threat — which is strictly how the problems tab within the platform types them.
For many small-to-midsize websites, the highest-impact enhancements fall into three classes:
- TLS and cipher suite configuration — Disable TLS 1.0 and 1.1; take away weak cipher suites. These are usually the highest-breach-risk community safety findings.
- HTTP safety headers — Add HSTS, CSP, X-Content material-Kind-Choices, and X-Body-Choices on the server degree. These tackle the majority of software safety findings.
- Certificates administration — Guarantee certificates use present signature algorithms (ECDSA or RSA-SHA256 minimal), implement OCSP stapling for revocation help, and goal certificates lifetimes that align with present finest practices.
All three require server-level entry. In case your present internet hosting setting doesn’t present that entry, fixing your rating means both working throughout the constraints of what your supplier helps, or shifting to an setting the place these selections are yours to make.
Find out how to Take Management of Your Safety Configuration
A SecurityScorecard score displays actual infrastructure selections, and infrastructure selections begin with the place your web site lives. In case your scorecard exhibits persistent configuration findings that your present internet hosting supplier can’t tackle, InMotion Internet hosting’s Devoted Servers provide the root entry, managed help, and safety experience to repair them — and hold them fastened.
