Compare your site's security

What the comparison measures

It scores what any outsider can verify about your site: the security headers you send, the Content Security Policy behind them, how you hold up against the attack classes that actually hit production sites, and whether your policies report anywhere. Nothing is installed and no account is needed: if a header is missing from your responses, it is missing for everyone who looks. The controls behind each axis are covered in our web security guides.

How the score is calculated

Six areas, each scored from 0 to 100, each read from the same public response:

• Security headers: every protective response header, judged on the value it carries rather than on being present.
• Content Security Policy: the policy your server sends, with permissive keywords, broad sources and missing directives weighted by what an attacker would use.
• Attack resistance: what the configuration would actually stop, across the common client-side attack routes.
• Policy enforcement: which policies you enforce rather than run in report-only mode, and how tightly each one is configured.
• Reporting-capable policies: whether the policies you send are wired to report violations rather than failing silently.
• Reporting setup: whether the endpoints you declare exist, are referenced correctly, and would receive what the browser sends.

The overall number averages only the areas your site was evaluated on, which is why a site with no policy at all shows fewer spokes rather than a row of zeros.

Who you are compared against

Your scores are charted against two references: the best cohort, meaning the best-configured sites of the year, and the dataset-wide average. Both come from the CentralCSP dataset, the same one behind our annual State of the Web report. The 2026 edition covers 761,345 scored domains, with a best cohort of 150 sites.

Both references are published and auditable, which is unusual for a benchmark. Security ratings products compare you to an industry cohort they do not disclose; here you can open the report and see how the population scores, control by control. The references refresh with each edition, so the bar moves as the web does.

How to read your security benchmark radar

One look at the radar tells you where you stand: each spoke is a control scored 0 to 100 for your site, the best cohort, and the average, so the controls carrying your gap are visible immediately. Two conventions keep the picture honest: a control that does not apply to you is left off the chart rather than dragging your polygon to zero, while a required control that is missing stays at 0, so a real gap is never hidden.

If a security ratings platform flagged your site

SecurityScorecard, Bitsight and RiskRecon read the same outside-in signals this scan does: your public responses, no agent, no access. Everything they can flag about your headers and client-side policies, this scan flags too, and it keeps going where their checklists stop: value-level findings, attack resistance, and whether your reporting actually works.

To see those findings on your own site, control by control, run one of these: CSP scanner, Security headers checker or Reporting API checker. Each one lists the exact headers and directives behind the score, and what to change.

If you are working from a specific finding, two walkthroughs cover the common ones: fix SecurityScorecard CSP findings and fix BitSight CSP findings. BitSight began rating CSP in July 2025: why BitSight now rates CSP.

CentralCSP is not affiliated with SecurityScorecard, Bitsight, RiskRecon or any ratings platform, and no tool can promise a specific score: this scan shows you the same outside-in evidence they measure, so you can fix the controls behind it.