Transparent by design
ShieldCircle evaluates the response returned to its server-side scanner. The grade describes observed header configuration, not the overall security of a website.
Weighted controls
| Control | Weight |
|---|---|
| Content Security Policy | 30 |
| HTTP Strict Transport Security | 20 |
| Frame protection | 15 |
| MIME sniffing protection | 15 |
| Referrer Policy | 10 |
| Permissions Policy | 10 |
Interpretation
Rules award evidence-based partial credit. Modern CSP semantics, browser defaults, compatibility tokens, and overlapping controls are considered. Supplemental cross-origin and disclosure observations do not affect the score because their suitability is application-dependent.
Limitations
A response can vary by geography, user agent, authentication state, cookies, path, and deployment edge. ShieldCircle does not exploit targets, execute application code, or certify compliance. A finding is not proof of a vulnerability.