TrustBeacon Auditor Scoring Guide
Version: 0.1.7

Purpose

The TrustBeacon Auditor score is intended to give a simple summary of a website's basic trust posture. It is not a security certification, compliance rating, or guarantee of safety.

The score should help a site owner answer three questions:

1. Does my website have the basic trust signals visitors and mail systems expect?
2. Which problems should I fix first?
3. Is my site improving over time?

Recommended Score Range

The total score should be normalized to a 0-100 scale.

Suggested Trust Level Ranges

A+: 95-100
Excellent basic public trust posture. Most checked trust signals are present.

A: 90-94
Strong basic public trust posture. Most important checks passed.

B+: 85-89
Very good basic public trust posture with a few improvements recommended.

B: 80-84
Good basic public trust posture. Some improvements are recommended.

C+: 75-79
Acceptable public trust posture, but several items should be reviewed.

C: 70-74
Several important trust signals are present, but meaningful gaps remain.

Needs Attention: 0-69
Several checked trust signals are missing, weak, or unavailable and should be reviewed.

Recommended Category Weights

The exact weights can change as the plugin matures. A reasonable first-version scoring model is:

HTTPS and SSL: 20 points
Email Security: 25 points
HTTP Security Headers: 25 points
DNS Security: 15 points
WordPress Configuration: 15 points

Total: 100 points

Detailed Suggested Weights

HTTPS and SSL: 20 points

HTTPS available: 10
HTTP redirects to HTTPS: 5
No obvious SSL/certificate problem detected: 5

Email Security: 25 points

SPF record present: 8
DKIM record present or likely configured: 7
DMARC record present: 7
DMARC policy stronger than p=none: 3

HTTP Security Headers: 25 points

Strict-Transport-Security: 5
Content-Security-Policy: 5
X-Frame-Options or frame-ancestors protection: 4
X-Content-Type-Options: 4
Referrer-Policy: 4
Permissions-Policy: 3

DNS Security: 15 points

Nameservers detected: 3
DNSSEC/DNSKEY appears available: 7
No obvious DNS lookup failure: 3
Additional DNS trust signals: 2

WordPress Configuration: 15 points

Basic WordPress access/configuration check: 4
XML-RPC exposure reviewed: 4
Version exposure reviewed: 3
Plugin/theme update awareness: 2
General site maintenance signal: 2

Status-to-Score Guidance

PASS
Award full points for the check. In the active scoring model, PASS findings receive 10/10.

WARNING
Award partial points when something exists but is weak, incomplete, uncertain, or needs review. In the active scoring model, WARN findings receive 6-9/10 so warnings do not create an artificially harsh score.

FAIL
Award zero points when a required item is missing or clearly broken.

INFO
Award no points and exclude the finding from the total score denominator. Informational findings should not raise or lower the score.

NOT EVALUATED
Usually award no points for that check unless the scoring model has a neutral handling method. Do not punish a site harshly when the plugin cannot evaluate something due to hosting limitations.

Recommended Handling of Unavailable Checks

Some checks may not be available in every PHP environment. For example, some servers may not support DNSKEY lookups. In those cases, the plugin should avoid false negatives.

Recommended options:

Option 1: Mark as NOT EVALUATED and exclude from the denominator.
This is the fairest method but requires dynamic score normalization.

Option 2: Mark as WARNING and award partial credit.
This is simpler but may slightly reduce the site's score for something the plugin could not prove.

Option 3: Mark as INFO and do not score it.
This is safest for early versions.

For early versions, Option 3 is recommended for checks that are unreliable in some hosting environments.

Scoring Philosophy

The score should reward important trust signals without pretending to know more than the plugin actually knows.

Good scoring should be:

* Conservative
* Explainable
* Repeatable
* Fair across hosting providers
* Clear to non-technical users

The individual findings should matter more than the final number.

Recommended Score Summary Language

95-100:
Your site has excellent basic public trust signals. Review any remaining recommendations for possible improvements.

90-94:
Your site has strong basic public trust signals. Review the remaining recommendations for possible improvements.

85-89:
Your site has very good basic public trust signals, with a few improvements recommended.

80-84:
Your site has good basic public trust signals, but some items should be improved.

70-79:
Your site has several important trust signals, but meaningful gaps remain.

0-69:
Several checked trust signals are missing, weak, or unavailable. Review failed and warning items first.

Important Disclaimer

A high score does not prove that the website is secure. A low score does not prove that the website has been hacked. The score is only a first-level trust and configuration indicator.
