Our free Surface Check gives your domain a single letter grade, from A to F, in about thirty seconds. It is a quick, honest read on one specific thing: what your application exposes to the public internet. This post explains what the grade is based on, what each band roughly means, and, just as importantly, what the score does not tell you.
What the Surface Score measures
The score is built from passive, external checks. It never logs in, never scans inside your app, and stores nothing about the result. It looks at the signals anyone on the internet can already see:
- Security headers that tell browsers how to protect your users.
- TLS, so traffic to your site is properly encrypted and up to date.
- Cookie flags, which control how your session cookies can be accessed.
- Email spoofing protection, meaning your SPF, DKIM, and DMARC records, which decide how easily someone can send email pretending to be your domain.
Each finding is weighted by how serious it is and how much effort it takes to fix, and those roll up into the single grade.
What each grade band means
A means your public surface is in good shape. The important protections are in place and there is little for an opportunist to grab onto.
B is solid, with a small number of easy wins left. Most teams can reach an A with an afternoon of fixes.
C means several protections are missing or misconfigured. Nothing here is exotic, but the gaps are the kind that make you an easier target than you need to be.
D and F mean the basics are largely absent. These are the quick, well-known issues that automated tools and opportunists look for first, and they are worth addressing promptly.
A lower grade is not a verdict on your whole product. It reflects your external surface, which is usually one of the fastest and cheapest parts of security to improve.
What counts as a good Surface Score?
A or B is the target. At that level the protections that stop the easy, automated attacks are in place, and you are no longer the low-hanging fruit an opportunist scans for. Aim for A if you can, since most of the remaining fixes at a B are quick, but a solid B is a reasonable place to sit while you work on deeper things.
C, D or F does not mean your product is unsafe, but it does mean the basics of your public surface need attention, and these are usually the cheapest issues to resolve. If you want to see whether your grade is good or middling compared with everyone else, our public Surface Score benchmark shows the anonymous distribution of grades across the domains that have been checked.
What the score does not measure
This is the part we are careful to be clear about. A passive external check cannot see inside your application, so it cannot judge the risks that live there. It will not catch broken access control, a database rule that lets anyone read a table, or a secret buried in your code. A strong Surface Score is a good sign, not a clean bill of health. Treat it as the first, easiest layer, not the whole picture.
How to improve your score
Most Surface Check findings have well-documented fixes: adding the missing security headers, tightening cookie flags, keeping TLS current, and completing your SPF, DKIM, and DMARC records. The tool lists each issue with what it means and how to fix it, so you can hand the list straight to whoever manages your domain and hosting.
Next steps
Run a free Surface Check to see your grade, then work through the fixes it lists. If you want a review that goes beyond the surface, into the access control, data handling, and configuration an external check cannot reach, our application security assessment is built for startups and fast-moving teams. We prepare the fixes and hand them to your team to review and deploy, or apply them directly where you have authorised us to do so in writing. You can get in touch through our website.