A SecurityScorecard score is an outside-in safety grade assigned to your group primarily based solely on what\u2019s publicly seen from the web. It doesn\u2019t require your cooperation, your credentials, and even your consciousness. SecurityScorecard<\/a> scans your public-facing infrastructure and scores what it finds \u2014 the identical means an attacker would take a look at your web site earlier than deciding whether or not to probe additional.<\/p>\n For those who\u2019ve acquired a scorecard from a consumer, a vendor, or your individual safety group and aren\u2019t certain what it means, this text explains what the platform measures, why sure points are troublesome to repair on shared or managed internet hosting, and what modifications with a devoted server.<\/p>\n <\/p>\n SecurityScorecard scans all the IPv4 tackle area \u2014 greater than 3.9 billion routable IP addresses \u2014 each 10 days throughout greater than 1,400 ports. The platform additionally scans cloud property a number of instances day by day as a result of cloud IP possession modifications incessantly.<\/p>\n The scan collects all the pieces an attacker would observe from the skin: uncovered ports, outdated software program variations, and identified vulnerabilities, together with knowledge from personal sources equivalent to risk intelligence feeds and vulnerability databases.<\/p>\n Nothing about this course of requires entry to your programs. Your rating displays what SecurityScorecard can see from the general public web \u2014 which can be what anybody attempting to compromise your web site would see first.<\/p>\n Scores replace day by day. In case your infrastructure and situation counts stay steady, your rating holds regular. For those who remediate a discovering, your rating improves, typically inside 24 to 48 hours after the subsequent scan cycle confirms the repair.<\/p>\n The letter grade \u2014 A by F \u2014 and the corresponding numeric rating from 100 to 0 replicate the statistical probability that your group will expertise a breach. The decrease the rating, the upper the probability.<\/p>\n The connection between grade and breach chance is critical:<\/p>\n Organizations with an F grade are 13.8 instances extra more likely to expertise a breach than these with an A. That\u2019s not a marginal distinction. A D-rated group sits one grade above that threshold, and a scheduled scoring recalibration can transfer the needle additional in both route.<\/p>\n SecurityScorecard charges corporations throughout 10 threat elements<\/a>: software safety, cubit rating, DNS well being, endpoint safety, hacker chatter, leaked credentials, IP status, community safety, patching cadence, and social engineering.<\/p>\n A number of of those are instantly related to how your server is configured:<\/p>\n Community Safety<\/strong> checks for insecure open ports, weak TLS protocols<\/a>, and misconfigured cipher suites. Insecure ports could be exploited to permit an attacker to avoid the login course of or acquire elevated entry to a system. If misconfigured, an open port acts as a direct entry level between a hacker\u2019s setting and your inside community.<\/p>\n Utility Safety<\/strong> evaluates whether or not your internet properties implement HTTP safety headers \u2014 controls like Content material Safety Coverage (CSP)<\/a>, HTTP Strict Transport Safety (HSTS)<\/a>, and X-Content material-Kind-Choices that browsers use to dam widespread assault vectors.<\/p>\n Patching Cadence<\/strong> measures how rapidly your group responds to identified vulnerabilities and applies patches, in comparison with friends of comparable measurement. Sluggish patching is among the most constantly penalized behaviors on the platform.<\/p>\n DNS Well being<\/strong> validates that DNS configuration is clear, that mail servers have correct spoofing protections (SPF, DKIM, DMARC<\/a>), and that no malicious occasions seem in your passive DNS historical past.<\/p>\n The remaining elements \u2014 IP status, endpoint safety, hacker chatter, leaked credentials \u2014 replicate issues like whether or not your IPs have appeared in malware feeds, whether or not credentials out of your group have proven up in breach knowledge, and whether or not your group is mentioned in risk actor communities.<\/p>\n A SecurityScorecard score has moved effectively past inside safety use. The platform\u2019s patented expertise is utilized by organizations for enterprise threat administration, third-party threat administration, board reporting, due diligence, cyber insurance coverage underwriting, and regulatory oversight.<\/p>\n Meaning your rating is more and more seen to events exterior your group:<\/p>\n That surprises a whole lot of web site house owners. Most assume a safety score is an inside compliance metric. For companies and companies that promote to enterprise shoppers, it capabilities extra like a credit score rating \u2014 seen to counterparties and able to affecting offers earlier than a dialog ever begins.<\/p>\n Most of the findings that seem on a SecurityScorecard report usually are not software program bugs or credential leaks. They\u2019re server configuration points \u2014 issues that exist or don\u2019t exist primarily based on selections made on the infrastructure degree.<\/p>\n Take into account what seems most incessantly on low-scoring websites:<\/p>\n TLS Protocol Assist:<\/strong> A server that also accepts connections over TLS 1.0 or TLS 1.1 is flagged as a high-severity community safety situation. These protocols had been deprecated by the IETF in 2021 due to identified cryptographic weaknesses. Whether or not these protocols are enabled or disabled is managed in your internet server configuration \u2014 Apache, NGINX, and Linux OS \u2014 not in your software code.<\/p>\n Cipher Suite Choice:<\/strong> Weak cipher suites \u2014 these utilizing RC4, 3DES, or export-grade encryption \u2014 are individually flagged. Which cipher suites your server advertises is ready in the identical internet server config information. An software working on WordPress or Magento has no management over this; the server controls it.<\/p>\n HTTP Safety Headers:<\/strong> CSP, HSTS, X-Content material-Kind-Choices, X-Body-Choices \u2014 these are headers that servers ship to browsers to limit what the browser is allowed to do with content material out of your area. Including them requires both a directive in your internet server configuration or middleware on the server degree. They can’t be reliably set from inside WordPress or a CMS plugin alone, and a CDN could override or strip headers relying on its configuration.<\/p>\n Certificates Configuration:<\/strong> Certificates lifetime, revocation help, and signature algorithm are properties of how a TLS certificates<\/a> is issued and configured on the server. These usually are not points inside your software; they\u2019re points with how the certificates is deployed.<\/p>\n That is the place internet hosting selection turns into a safety query, not only a efficiency or worth query.<\/p>\n On shared internet hosting \u2014 together with restrictive managed WordPress platforms \u2014 the server is configured and maintained by the internet hosting supplier. That\u2019s the tradeoff: you don\u2019t must handle the server, however you can also\u2019t configure it. The online server that serves your web site is shared with dozens or tons of of different prospects, and its configuration displays the supplier\u2019s decisions, not yours.<\/p>\n In case your internet hosting supplier hasn\u2019t disabled TLS 1.0 throughout the platform, your web site will proceed promoting TLS 1.0 help. If HSTS isn\u2019t configured on the server degree, your web site gained\u2019t ship HSTS headers even in order for you it to. And since that configuration serves 1000’s of web sites, suppliers are sluggish to vary it \u2014 any misconfiguration impacts each buyer.<\/p>\n Managed WordPress hosts particularly optimize for WordPress efficiency and uptime. Server-level safety hardening is often not a part of what they promote. While you ask them to switch cipher suites or add world safety headers, the reply is usually both \u201cwe are able to\u2019t do this\u201d or \u201csubmit a help ticket and we\u2019ll evaluation it\u201d \u2014 with no timeline and no assure.<\/p>\n This creates a predictable state of affairs<\/strong>: findings seem in your SecurityScorecard report, you look into fixing them, and also you uncover the repair requires server entry you don\u2019t have.<\/p>\n A devoted server provides you root entry to a bodily machine that nobody else shares. Each configuration determination \u2014 which TLS variations the server accepts, which cipher suites it advertises, which HTTP headers it sends, how certificates are managed \u2014 is yours to make.<\/p>\n Meaning each situation within the Community Safety and Utility Safety classes of a SecurityScorecard report turns into actionable. Disabling TLS 1.0 and 1.1 on an Apache server takes a single configuration change and a service reload. Including HSTS to each response is three strains in a server block. Implementing a strict Content material Safety Coverage requires entry to the identical configuration file. None of those require a help ticket. None require ready for a supplier to behave.<\/p>\n On InMotion Internet hosting\u2019s Devoted Servers<\/a>, you’ve gotten full root entry and full cPanel\/WHM management. For purchasers preferring a guided strategy, InMotion Options<\/a> \u2014 the in-house sysadmin group \u2014 can implement server-level hardening, deal with TLS configuration, and validate modifications in opposition to safety scoring standards. The Premier Care Bundle provides proactive safety administration with Monarx malware protection and Superior Product Assist.<\/p>\n The sensible final result:<\/strong> configuration-related SecurityScorecard findings which are unfixable on shared internet hosting turn out to be achievable on a devoted server.<\/p>\n Just a few clarifications value making, as a result of the platform is usually overstated in what it covers.<\/p>\n SecurityScorecard measures your exterior assault floor<\/strong> \u2014 what\u2019s seen from the general public web. It doesn’t consider your inside community safety, your entry controls, your worker coaching, or your incident response procedures. An ideal SecurityScorecard rating doesn’t imply your group has no safety vulnerabilities; it means your publicly-facing infrastructure doesn\u2019t exhibit the alerts the platform checks.<\/p>\n The platform additionally has identified limitations round IP attribution. IP attribution points are cited as widespread scanning issues, and a few customers report misflagged IPs requiring help intervention. If findings seem that don\u2019t match your infrastructure, SecurityScorecard supplies a dispute course of for reviewing and contesting misattributions.<\/p>\n Scores additionally replicate your peer setting. SecurityScorecard applies a logarithmic scale and calibrates scores in opposition to greater than 12 million organizations, evaluating your situation quantity to others of comparable measurement and digital footprint. A small enterprise and an enterprise don\u2019t compete on uncooked discovering counts.<\/p>\n For those who\u2019re a scorecard with a number of open points, probably the most sensible path is to work from highest to lowest breach threat \u2014 which is strictly how the problems tab within the platform types them.<\/p>\n For many small-to-midsize websites, the highest-impact enhancements fall into three classes:<\/p>\n All three require server-level entry. In case your present internet hosting setting doesn\u2019t present that entry, fixing your rating means both working throughout the constraints of what your supplier helps, or shifting to an setting the place these selections are yours to make.<\/p>\n A SecurityScorecard score displays actual infrastructure selections, and infrastructure selections begin with the place your web site lives. In case your scorecard exhibits persistent configuration findings that your present internet hosting supplier can\u2019t tackle, InMotion Internet hosting\u2019s Devoted Servers<\/a> provide the root entry, managed help, and safety experience to repair them \u2014 and hold them fastened.<\/p>\n<\/p><\/div>\nHow Does SecurityScorecard Measure Your Safety?<\/h2>\n
What Does the Letter Grade Really Imply?<\/h2>\n
![\"SecurityScorecard](\"https:\/\/www.inmotionhosting.com\/blog\/wp-content\/uploads\/2026\/05\/security-scorecard-rating.png\")
<\/figure>\n<\/div>\n\n
What Are the ten Danger Elements SecurityScorecard Evaluates?<\/h2>\n
Why Do Enterprise Shoppers and Procurement Groups Care About Your Rating?<\/h2>\n
\n
Which Points on Your Scorecard Are Internet hosting Configuration Issues?<\/h2>\n
![\"Infographic](\"https:\/\/www.inmotionhosting.com\/blog\/wp-content\/uploads\/2026\/05\/Ultimate-Guide-Infographics-HTTPS-Connections-1024x416.png\")
<\/figure>\nWhy Shared and Restrictive Internet hosting Environments Restrict What You Can Repair<\/h2>\n
What Modifications with a Devoted Server<\/h2>\n
What SecurityScorecard Does Not Measure<\/h2>\n
Find out how to Begin Bettering Your Rating<\/h2>\n
\n
Find out how to Take Management of Your Safety Configuration<\/h2>\n