How the Web Security Index is calculated
WSI is a transparent, rubric-based indicator of security controls observable from a public website homepage. It is designed for repeatable comparisons across large cohorts—not as a substitute for a penetration test, compliance audit, or statement that a site is secure.
Score at a glance
Total range: 0–150 points per origin.
Scoring principles
Observable evidence
Additive and reproducible
One origin, one score
Context stays separate
Final 2xx pages only
Current rubric
The active rubric is Web Security Index v2 (`wsi-2026-v2`). Every component has a maximum of 50 points.
Content Security
CS component
| Observed control | Points |
|---|---|
Strict-Transport-Security Tells browsers to use HTTPS and helps prevent protocol downgrade attacks. | 10 |
Cookies: Secure Awards points when at least one observed Set-Cookie instruction explicitly includes Secure, which restricts transmission of that cookie to HTTPS. | 8 |
Cookies: HttpOnly Awards points when at least one observed Set-Cookie instruction explicitly includes HttpOnly, which prevents JavaScript from reading that cookie. | 8 |
Cookies: SameSite Awards points when at least one observed Set-Cookie instruction explicitly sets SameSite=Lax, Strict, or None. This measures explicit configuration; None permits cross-site sending. | 8 |
Subresource Integrity Requires the initial homepage HTML to declare at least one script or stylesheet with a syntactically valid SHA-256, SHA-384, or SHA-512 integrity hash; dynamically injected elements do not count. | 6 |
Referrer-Policy Controls how much referring URL information is shared with other destinations. | 5 |
X-Content-Type-Options Prevents browsers from guessing a response type different from the declared MIME type. | 5 |
Cross-Origin Security
COS component
| Observed control | Points |
|---|---|
Content-Security-Policy Restricts permitted content sources and helps limit script and content injection. | 20 |
Access-Control-Allow-Origin Declares which external origins may read a cross-origin response. | 10 |
Access-Control-Allow-Methods Limits the HTTP methods permitted for cross-origin requests. | 5 |
Cross-Origin-Opener-Policy Isolates the top-level page from untrusted cross-origin browsing contexts. | 5 |
Cross-Origin-Embedder-Policy Requires embedded cross-origin resources to explicitly grant permission. | 5 |
Cross-Origin-Resource-Policy Controls which other sites are allowed to load or embed a resource. | 5 |
Network & Protocol Security
NPS component
| Observed control | Points |
|---|---|
Modern HTTP (HTTP/2 or HTTP/3) Indicates current protocol support, normally deployed by browsers over encrypted transport. | 20 |
Valid TLS certificate Authenticates the public endpoint and enables browsers to establish trusted encryption. | 15 |
DNSSEC enabled Authenticates DNS answers and reduces the risk of forged or manipulated DNS records. | 15 |
Cookie attributes measure observed adoption. Secure, HttpOnly, and SameSite each receive their full 8 points when explicitly present at least once in the Set-Cookie instructions observed during the homepage GET and its redirect chain, provided the final page is eligible. SameSite must have the value Lax, Strict, or None. The three attributes are evaluated independently and may occur on different cookies; other cookies without the attribute do not cancel the evidence.
The research assumption is that one explicit occurrence demonstrates use of the mechanism. WSI does not assess whether each cookie needs each attribute or whether the application has configured every cookie correctly. No observed Set-Cookie instructions means no cookie-attribute points. Browser defaults do not count as explicit configuration. Adoption percentages in the portal describe the share of scored origins where an attribute was observed at least once, rather than the share of cookies carrying it.
Current semantic limit: response-header checks award points for observed presence. The rubric does not yet grade the full policy quality of CSP, CORS, or other header values. Boolean checks such as TLS validity, cookie flags, SRI, and DNSSEC require an affirmative observed fact.
From origins to public aggregates
- 1
Origin
The rubric produces CS, COS, NPS, and WSI only for a final HTTP 2xx homepage observation.
- 2
Country and rank cohort
Country values are arithmetic means across eligible origins in the same measurement and rank cohort.
- 3
Category
The same origin scores are grouped by the stored eight-category classification for explanatory breakdowns.
- 4
Regional summaries
When category summaries are combined, the portal uses origin-weighted means so a small category cannot count as much as a category with thousands of sites.
Versioning and publication integrity
Rubrics are versioned. A published measurement is pinned to the rubric used for its public aggregates, so later private re-scoring cannot silently rewrite historical results. Exceptional evidence-policy repairs are audited, fully recalculated, timestamped, and explicitly republished.
Interpretation and limitations
- Higher means more observed controls, not absence of vulnerabilities. WSI does not test application logic, authentication, authorization, patch level, malware, or internal infrastructure.
- A score is time- and vantage-point-specific. CDN behavior, geolocation, transient failures, redirects, and bot challenges can affect observable evidence.
- Missing evidence is distinguishable from cohort coverage. Public pages show sample counts and measurement periods so comparisons can be interpreted within the same population.
- Legacy-to-current comparisons are descriptive. Legacy observations have no HTTP status provenance, so they cannot be filtered retrospectively by the final-2xx eligibility rule. Charts show a methodology break and suppress direct change claims across it.