I built DHSea Score, a free website report card, so the obvious first test was my own site. It reads one public page once, scores 51 fixed checks across five categories, and lists the top fixes in plain English. It never logs in or crawls.
The first grade: 86 (B)
SEO, Accessibility and Best practices were already 100. Security was 59 (F). The report's top fixes named the cause: no Content-Security-Policy, no clickjacking protection, and an HTML document of 207 KB against a 200 KB limit.
The fix: four response headers
The gap was on the server side, so the fix was too. A very small WordPress plugin now adds four headers on public pages: X-Content-Type-Options: nosniff, a Referrer-Policy, a Permissions-Policy, and a Content-Security-Policy limited to framing, the base tag and objects. It touches no page content, and deactivating it removes every header at once.
Before regrading, I read the headers off the live site logged out, with the cache bypassed, on seven different pages. All four were there.
The second grade: 97 (A+)
Security went from 59 to 100. Both reports counted 44 of the 51 checks (the rest couldn't be measured).
One caveat, because a tool that grades its author should say it. That CSP passes the grader because a policy exists and blocks framing by other sites. It does not restrict which scripts run, and on this site it can't: my pages carry their code inline. So the A+ means the headers are present and correct for what they cover. It doesn't mean the site is hard to attack.
The C- I left alone
Speed (server-side proxies) is 70 on both reports. The server answered in 54 ms, so it isn't the server. Two checks fail: HTML at 207 KB against 200 KB, and inline script and style at 161 KB against 100 KB.
Fixing both means moving the inline code into separate cacheable files and reworking every page that depends on it, to raise a category worth 10 percent of the score. I decided that was a bad trade today. It stays on the list.
What two reports taught me
- A grade is a to-do list. The top fixes were the whole plan.
- The cheapest fix was the one that changed no content.
- Verify the cause on the live site before you regrade.
- Put the limits of your score next to the score.
- Leave a low number visible when fixing it costs more than it's worth.
Grade a page: https://gradesite.dhseadev.online/ (two free grades a day, five with a free account).
What each category checks: https://dhseadev.online/projects/dhsea-score/
Why it's built to encourage rather than shame: https://dhseadev.online/2026/10/16/a-report-card-that-is-on-your-side/
Top comments (0)