How your scores are calculated
Every score in Storebix is rule-based and reproducible: we start at 100 and subtract points for each issue we find, weighted by how serious it is. No hidden factors, no manual adjustments.
Security Score
SSL, headers, malware, blacklists, exposed files and 11 more checks.
SEO Score
Meta tags, content, schema, Core Web Vitals, ecommerce & AI visibility.
Security Score
Your Security Score reflects everything found across all 16 checks run during a scan. It starts at 100, and every issue found deducts points based on its severity.
The formula
Each finding deducts a fixed number of points depending on its severity. To keep any single category of problem from unfairly dominating the score, deductions are capped per severity — so, for example, having 10 medium-severity issues doesn't cost more than 3 would.
| Severity | Points lost per issue | Maximum lost from this severity |
|---|---|---|
| Critical | −20 | −60 (after 3 issues) |
| High | −10 | −30 (after 3 issues) |
| Medium | −5 | −15 (after 3 issues) |
| Low | −2 | −8 (after 4 issues) |
| Info | 0 | never affects your score |
Worked example: a scan with 2 High, 7 Medium and 7 Low findings loses 20 points for High, 15 points for Medium (capped — only 3 of the 7 count), and 8 points for Low (capped — only 4 of the 7 count). 100 − 43 = a score of 57.
What your score means
90–100
Excellent
80–89
Good
70–79
Needs Attention
50–69
High Risk
0–49
Critical
What we check
Tap any category to see exactly what can trigger a finding, and at what severity.
Malware Detection10 checks
Scans your page's HTML and scripts for signs of injected or malicious code.
| Known crypto-mining script detected | Critical |
| Leaked API key or password found in page data | Critical |
| Obfuscated/packed JavaScript hiding its real behavior | High |
| Hidden iframe embedded in the page | High |
| Phishing-style form collecting passwords or card details | High |
| Use of code-execution functions commonly abused by malware | Medium |
| Scripts created dynamically at runtime | Medium |
| Use of document.write() | Low |
| Large embedded encoded data blob | Low |
| Suspicious script-loading pattern | Low |
SSL/TLS Certificate8 checks
Confirms your site is served securely with a valid, trusted certificate.
| No HTTPS in use at all | Critical |
| Certificate has expired | Critical |
| Certificate expires within 30 days | High |
| Self-signed or untrusted certificate | High |
| Outdated, insecure TLS version in use | High |
| Could not establish a secure connection | High |
| HSTS (forced HTTPS) not enabled | Medium |
| HSTS enabled but set for less than a year | Low |
Security Headers10 checks
Checks for the response headers browsers use to block common attacks like clickjacking and script injection.
| Missing Content-Security-Policy header | High |
| Missing or weak Strict-Transport-Security header | High |
| Missing X-Frame-Options header | Medium |
| Missing X-Content-Type-Options header | Medium |
| Missing Referrer-Policy header | Low |
| Missing Permissions-Policy header | Low |
| Missing Cross-Origin-Opener-Policy header | Low |
| Missing Cross-Origin-Resource-Policy header | Low |
| Server header reveals version information | Low |
| X-Powered-By header exposes your tech stack | Low |
Cookie Security3 checks
Checks that cookies are configured to resist theft and cross-site attacks.
| Cookie missing the Secure flag on an HTTPS site | Medium |
| Session/login cookie missing HttpOnly protection | Medium |
| Cookie missing a SameSite attribute | Low |
DNS Records & SPF/DMARC2 checks
Confirms your domain has anti-spoofing email records in place.
| No SPF record found | Medium |
| No DMARC record found | Medium |
Blacklist Check2 checks
Checks your domain against phishing and malware blacklists.
| Domain found on a phishing blacklist | Critical |
| Domain flagged by a malware/safe-browsing database | Critical |
CMS & Version Detection2 checks
Identifies your CMS/platform and compares its version against the latest known release.
| Running an outdated CMS version | High |
| CMS or version information is publicly exposed | Low |
Sensitive File Exposure4 checks
Probes for common configuration, backup and admin files that shouldn't be publicly reachable.
| Environment file, database dump, backup archive or credentials file reachable | Critical |
| Version-control, server config or installer file reachable | High |
| Admin panel, package manifest or build config reachable | Medium |
| Deployment config or license/readme file reachable | Low |
SEO Spam Detection3 checks
Looks for spam content injected by attackers to hijack your search rankings.
| Spam keywords found in page content (gambling, pharma, adult, etc.) | High |
| Large volume of spam keywords found | Critical |
| Spam keyword found inside a visible link | High |
Mixed Content1 checks
Checks that a secure (HTTPS) page isn't quietly loading insecure resources.
| An insecure (HTTP) resource loads on an HTTPS page | Medium |
External Resources3 checks
Reviews third-party scripts and assets your site depends on.
| A resource loads from a raw IP address instead of a domain | High |
| A resource loads over an insecure connection | Medium |
| A resource loads from a domain associated with abuse | Medium |
Technology Stack5 checks
Identifies your server, language runtime and frameworks, flagging outdated or exposed versions.
| Outdated PHP version in use | High |
| Outdated Node.js version in use | High |
| Development mode accidentally left on in production | High |
| Developer tools exposed in production | Medium |
| Runtime version disclosed publicly | Low |
Redirect Analysis5 checks
Follows your site's redirects to catch hijacking or excessive hops.
| Redirects to a known malicious/spam category of site | Critical |
| Unexpected redirect to another domain | Medium |
| Long redirect chain (more than 3 hops) | Low |
| Redirect triggered via JavaScript | Low |
| Redirect triggered via a meta refresh tag | Low |
Hidden Content3 checks
Detects elements deliberately hidden from visitors — a common sign of cloaking or injected spam.
| Hidden iframe found | High |
| Hidden link(s) found | High |
| Hidden form(s) found | High |
Defacement Detection2 checks
Looks for signs your site has been visibly compromised.
| Defacement message detected on the page | Critical |
| Page loads but content is suspiciously blank | High |
Performance Indicators4 checks
Lightweight checks on page weight and caching — not a full speed audit.
| Page is unusually large (over 5MB) | Medium |
| Response is not compressed | Low |
| No caching headers set | Low |
| Unusually high number of external scripts | Low |
SEO Score
A separate score from the Security Score, covering how easy your site is for search engines — and increasingly, AI assistants — to find, understand and rank.
The formula
The same idea as the Security Score — start at 100, deduct capped points per severity — with its own weighting, and it maps to a letter grade instead of a risk label.
| Severity | Points lost per issue | Maximum lost from this severity |
|---|---|---|
| Critical | −20 | −40 (after 2 issues) |
| High | −10 | −30 (after 3 issues) |
| Medium | −5 | −20 (after 4 issues) |
| Low | −2 | −10 (after 5 issues) |
| Info | 0 | never affects your score |
Grades
90–100
A
75–89
B
60–74
C
45–59
D
0–44
F
Site-wide checks
Covers every page you scan, whether or not you sell online.
Meta Tags10 checks
| No page title set | Critical |
| No viewport tag (breaks mobile rendering) | High |
| No meta description | High |
| Title is too short (under 30 characters) | High |
| Title is too long (over 60 characters) | Medium |
| Description is too short (under 70 characters) | Medium |
| Missing social preview (Open Graph) tags | Medium |
| Description is too long (over 160 characters) | Low |
| No Twitter card tag | Low |
| No favicon set | Low |
Content & Structure11 checks
| No H1 heading on the page | Critical |
| More than one H1 heading | High |
| Very little text content on the page (under 100 words) | High |
| Thin content (100–299 words) | Medium |
| No subheadings (H2) used at all | Medium |
| Content is hard to read | Medium |
| Image(s) missing descriptive alt text | Medium |
| Heading levels skip (e.g. H1 straight to H3) | Low |
| Multiple images with blank alt text | Low |
| Title and description repeat each other | Low |
| Images not using lazy loading | Low |
Links3 checks
| Broken internal links found | Medium |
| No internal links found on the page | Medium |
| A link redirects through 3+ hops before landing | Low |
Structured Data (Schema)3 checks
| No structured data present at all | High |
| No Product schema | Medium |
| No breadcrumb, organization or website schema | Low |
Indexing (Canonical, Robots, Sitemap)9 checks
| robots.txt blocks search engines from the entire site | Critical |
| robots.txt blocks product/catalog pages | High |
| Canonical tag points to the wrong page | High |
| No sitemap found | High |
| Sitemap found but empty | High |
| No canonical tag set | Medium |
| No robots.txt file found | Medium |
| Sitemap lists very few pages | Medium |
| Sitemap not referenced from robots.txt | Low |
Core Web Vitals8 checks
Live performance data from Google PageSpeed Insights.
| Very poor page-speed score | Critical |
| Slow Largest Contentful Paint (over 4s) | High |
| High layout shift while loading | High |
| Low SEO score from Lighthouse | High |
| Moderate page-speed score | Medium |
| Accessibility issues detected | Medium |
| Somewhat slow Largest Contentful Paint (2.5–4s) | Medium |
| Some layout shift while loading | Medium |
Ecommerce checks
A deeper audit for product and catalog pages.
Product Schema7 checks
| No Product schema found | Critical |
| Missing required product details (name, image, SKU, price…) | High |
| Product schema present but no pricing/offer information | High |
| Missing recommended details (brand, GTIN/MPN, ratings) | Medium |
| Offer is missing a valid-until date | Medium |
| No review/rating data | Low |
| No breadcrumb data | Low |
Content & Duplicates5 checks
| Extremely thin product description (under 80 words) | Critical |
| Thin product description (80–199 words) | High |
| Description looks copied from elsewhere | High |
| URL structure risks duplicate-page indexing | High |
| Variant URL missing duplicate-content protection | Medium |
Image SEO4 checks
| Product image(s) missing alt text | Medium |
| Oversized product image (hurts load time) | Medium |
| Generic, non-descriptive image filename | Medium |
| Images not using a modern, efficient format | Low |
Technical13 checks
| Session ID present in URL (wastes crawl budget) | Critical |
| Filter/sort URL has no duplicate-content protection | High |
| Internal search results are indexable | High |
| No product sitemap found | High |
| Missing reciprocal language links (hreflang) | High |
| Out-of-stock product returns a hard error page | High |
| No canonical tag on a product page | High |
| Out-of-stock page not handled correctly | Medium |
| Paginated page missing duplicate-content protection | Medium |
| Tracking parameters without duplicate-content protection | Medium |
| Infinite scroll used without proper pagination markup | Medium |
| No image sitemap | Medium |
| Sitemap hasn’t been updated recently | Low |
Shopping Feed Readiness4 checks
Checks the fields needed for your products to appear in Google Shopping.
| No product identifier (GTIN or MPN) present | High |
| Missing several required feed fields | High |
| Missing a few required feed fields | Medium |
| No product category set | Medium |
AI & LLM Visibility
Whether AI assistants like ChatGPT, Claude and Perplexity can access and understand your site — separate from traditional search SEO.
AI Crawler Access4 checks
| Most AI crawlers are blocked from the site | High |
| Google’s AI Overviews crawler is specifically blocked | High |
| Some AI crawlers are blocked | Medium |
| No llms.txt file found | Medium |
Answer Engine Optimization3 checks
How 'quotable' your content is for AI-generated answers.
| No FAQ structured data | Medium |
| No question-style headings on the page | Low |
| No content directly answering a heading’s question | Low |