How AstraScope scores your site
A score is only useful if you can see how it was produced. Here is the exact method — no black box.
The AstraScope Score
Four categories are scored independently — Security, Accessibility, SEO and Performance. Each starts at 100 and loses points for each distinct issue found. The overall AstraScope Score is the equally weighted average of those four (25% each), rounded and clamped to 0–100.
Reliability (uptime and incidents) is reported separately rather than folded into the score, because it measures a different thing over a different time window.
Severity deductions
Each distinct issue reduces its category score by a fixed amount:
One issue counts once
Findings are grouped by the rule that produced them before scoring. A single misconfiguration that appears on two hundred pages is one finding with two hundred affected URLs — not two hundred deductions. Without this, large sites would be penalised simply for being large.
Because rule identity is stable, we can also tell you which findings are new, ongoing or resolved compared with your previous audit.
What gets checked
- Security — response headers and transport configuration: HTTPS, HSTS, CSP, frame protection, content-type options, referrer policy, cookie flags.
- SEO — titles, meta descriptions, canonical URLs, headings, document language, indexability, sitemap and robots availability, broken internal links.
- Accessibility — automated checks including image alternatives, document language and responsive viewport.
- Performance — laboratory measurements: server response time, document size, and browser render timings on the homepage.
Crawl boundaries
Audits stay on your own origin, respect robots.txt, and are bounded in page count (by your plan), crawl depth, concurrency and response size. Only safe GET requests are made, and state-changing paths (sign-out, cart, admin) are skipped. To keep costs predictable, full browser rendering is used on your homepage while remaining pages are analysed at the HTTP level.
Monitoring
Uptime checks run on your plan’s interval and record status, response time and errors. To avoid alerting on a single blip, an incident opens only after two consecutive failed checks, and resolves on the first successful one. You get exactly one notification when it opens and one when it recovers.
Limits you should know
- Security checks are passive configuration checks. They are not a penetration test, and a perfect score does not mean your site is secure.
- Automated accessibility testing catches a meaningful subset of issues but cannot certify WCAG compliance. Manual testing is still required.
- Performance figures are laboratory measurements from a single render, not field data from your real visitors.
- Scores are a prioritisation aid, not an industry certification.