When visitors arrive at your website, they have no way to verify your security posture. They are trusting you — with their email, their data, sometimes their payment information — without any independent confirmation that your site is secure. A Shieldome certificate changes that: it is a publicly verifiable, machine-generated proof point that your site has been scanned against the OWASP Top 10 and met a concrete risk threshold.

This guide explains exactly how to earn a Shieldome certificate, what the grading means, and why it is worth displaying on your site.

How the grading system works

Every Shieldome scan produces a risk score from 0 to 100. The score is calculated from the severity of each finding:

The score maps to a letter grade: A (0–9), B (10–29), C (30–49), D (50–69), F (70+). Certification is awarded to sites that achieve Grade A or B — meaning a risk score below 30.

The math is intuitive: a site with no critical or high findings and only a few mediums will typically land in Grade A or B territory. A single unpatched critical vulnerability pushes the score to 25 on its own, which keeps you in the certifiable range, but a second critical brings you to 50 — Grade C, not certified.

The most common reasons sites fail certification

Missing security headers (Medium, +8 each)

Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy are all checked by Shieldome. Many developers skip these because they are not enforced by browsers as hard errors, but each one that is missing adds to your score. A site missing all five adds 40 points — enough to drop from a potential Grade A to Grade C on headers alone.

Fix: Add these headers to your server or CDN configuration. For nginx:

add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;

Content-Security-Policy requires more thought — start with a report-only mode and tighten iteratively.

HTTPS not enforced (High, +15)

If your site is accessible over HTTP without an automatic redirect to HTTPS, Shieldome flags it as a high-severity finding. This is the most common issue on newly deployed sites: HTTPS is configured, but the redirect is not.

Fix: Add a permanent redirect from HTTP to HTTPS at the web server level, and enable HSTS so browsers remember the preference.

Insecure cookies (Medium, +8)

Session cookies without the HttpOnly, Secure, or SameSite flags are readable by JavaScript and transmittable over HTTP. Each insecure attribute is flagged.

Fix: Set all three flags: Set-Cookie: session=...; HttpOnly; Secure; SameSite=Strict.

Sensitive path exposure (varies)

Accessible /.env, /phpinfo.php, /.git/config, or similar paths are typically flagged at High or Critical severity because they can expose credentials or source code directly.

Fix: Block access to these paths in your web server configuration. They should never return a 200 response in production.

Step-by-step: from first scan to certified

Step 1: Run a baseline scan

Start with a full vulnerability + performance scan of your production URL. The results page will show your risk score, grade, and each finding broken down by severity with a specific description of the issue and remediation advice.

Step 2: Triage by impact on score

Sort findings by severity: Critical and High first. Each critical fixed saves 25 points; each high fixed saves 15. In most cases, fixing 2–3 findings is enough to cross the certification threshold. You do not need a perfect score — Grade B (score 10–29) qualifies.

Step 3: Fix and re-scan

Apply the fixes, deploy, and run a new scan. Shieldome shows a delta view comparing the new scan to the previous one so you can confirm which findings were resolved. Each scan uses 1 token.

Step 4: Certificate issued automatically

If your new scan achieves Grade A or B, a public certificate is generated instantly. No manual application, no waiting period. A banner appears in the results panel with a direct link to your certificate page and embed code for the badge.

The badge: what it signals and to whom

The embeddable Shieldome badge is a 240×40px SVG that renders at any resolution. It shows the Shieldome logo, "Certified by Shieldome", and your current grade in a colored pill. The badge is served live — when you run a new scan that achieves certification, the badge updates to show the latest grade without any changes on your end.

Who notices? More people than you might expect:

Maintaining certification over time

Your certificate reflects the scan it was issued for, not a continuous monitoring state. New vulnerabilities introduced by code changes, dependency updates, or configuration drift can lower your grade over time. The recommended approach:

A Grade A site that stays Grade A over six months is a much stronger signal than one that dips in and out of certification. Consistency matters.

Start today

The fastest path to certification is usually 30 minutes: run a scan, fix the top 2–3 findings, deploy, re-scan. Most sites with basic security hygiene (HTTPS, HSTS, a few response headers) qualify on the first try. Create a free account to get started — you receive 1 free scan token on signup.