siteIQ methodology

The siteIQ Trust Score, explained

Q: How is the overall siteIQ score calculated?

It's the average of six category scores — Security, Performance, SEO, Accessibility, Infrastructure and Privacy — each scored 0-100, then rounded.

Q: Why does Performance start at 50 instead of 100?

Performance and Infrastructure are additive scores: they start from a neutral baseline and add points for confirmed good practices (compression, caching, a CDN, fast response times), rather than only subtracting for problems.

Q: Why does Security start at 100 instead of a baseline?

Security, SEO and Accessibility are deduction-based: every site starts at a perfect 100 and loses points only for confirmed, specific findings — so a score reflects exactly what's wrong, weighted by severity.

Q: What's the difference between the letter grade and the risk level?

The grade (A+ to F) summarizes the overall 0-100 score. The risk level (Low/Medium/High/Critical) is a coarser read of the same number, meant for a faster at-a-glance read.

Q: Does the score check things GTmetrix or Screaming Frog don't?

Yes — siteIQ's score blends security headers, SEO fundamentals, accessibility and infrastructure signals into one number, not just page speed. See the direct comparisons at /siteiq/vs-gtmetrix and /siteiq/vs-screaming-frog.

Q: Can two sites with the same overall score have different problems?

Yes — the overall number is an average, so a site weak on Security but strong on Performance can land on the same score as a site with the opposite mix. Always check the six category scores, not just the headline number.

Every siteIQ audit produces a single 0-100 score. It isn't a black box — it's the average of six category scores, each calculated by an explicit, deterministic formula against the same live response headers and rendered HTML every time. Here's exactly how each one works.

The six category scores

Security

Deduction-based, starts at 100

Each Critical finding costs 25 points, High costs 12, Medium costs 6. Headers checked include CSP, HSTS, X-Frame-Options, X-Content-Type-Options, and whether HTTPS is enforced at all.

SEO

Deduction-based, starts at 100

High-severity issues (missing title, missing canonical, missing H1) cost 15 points each, Medium issues cost 8, Low issues cost 4 — covering meta tags, structured data, robots.txt and sitemap references.

Accessibility

Deduction-based, starts at 100

High-severity issues (missing viewport tag, unlabeled form inputs, images with no alt text) cost 20 points each, Medium issues cost 10 — a WCAG-aligned pass over the rendered page.

Performance

Additive, starts at 50

+15 for gzip/Brotli compression, +15 for caching headers, +10 for a detected CDN, +5 if 10 or fewer external scripts are loaded, +5 for a sub-500ms response time (−10 if it's over 2000ms).

Infrastructure

Additive, starts at 60

+15 for HTTPS, +10 for a detected CDN, +10 for a detected Web Application Firewall, +5 for a sub-800ms response time.

Privacy

Additive, starts at 70

+10 each for a Content-Security-Policy header, a Permissions-Policy header, and a Referrer-Policy header.

Overall score = the average of all six category scores, rounded to the nearest whole number.

Grade bands & risk levels

Overall score	Letter grade	Risk level
90-100	A+	Low risk (80+)
80-89	A	Low risk (80+)
70-79	B	Medium risk (60-79)
60-69	C	Medium risk (60-79)
50-59	D	High risk (40-59)
0-49	F	High/Critical risk (<40)

FAQ

Score methodology FAQs

How is the overall siteIQ score calculated?

It's the average of six category scores — Security, Performance, SEO, Accessibility, Infrastructure and Privacy — each scored 0-100, then rounded.

Why does Performance start at 50 instead of 100?

Performance and Infrastructure are additive scores: they start from a neutral baseline and add points for confirmed good practices (compression, caching, a CDN, fast response times), rather than only subtracting for problems.

Why does Security start at 100 instead of a baseline?

Security, SEO and Accessibility are deduction-based: every site starts at a perfect 100 and loses points only for confirmed, specific findings — so a score reflects exactly what's wrong, weighted by severity.

What's the difference between the letter grade and the risk level?

The grade (A+ to F) summarizes the overall 0-100 score. The risk level (Low/Medium/High/Critical) is a coarser read of the same number, meant for a faster at-a-glance read.

Does the score check things GTmetrix or Screaming Frog don't?

Yes — siteIQ's score blends security headers, SEO fundamentals, accessibility and infrastructure signals into one number, not just page speed. See the direct comparisons at /siteiq/vs-gtmetrix and /siteiq/vs-screaming-frog.

Can two sites with the same overall score have different problems?

Yes — the overall number is an average, so a site weak on Security but strong on Performance can land on the same score as a site with the opposite mix. Always check the six category scores, not just the headline number.

Back to siteIQ →