How Super Site Report Works: Our Methodology
Super Site Report scores a website out of 100 across five areas: security, performance, SEO, accessibility and best practices. We fetch the page you enter, crawl up to 25 internal pages, run a Google Lighthouse lab test in headless Chrome, and turn every problem we find into a plain-English issue with a severity, an explanation and a fix. The overall grade is a weighted average of the five category scores.
What does Super Site Report check?
| Category | Weight | What we look at |
|---|---|---|
| Security | 25% | HTTPS and redirects, TLS certificate validity and expiry, HSTS, Content-Security-Policy and other security headers, cookie flags, exposed server/version details, mixed content, and email-domain DNS records (SPF, DMARC, CAA). |
| Performance | 25% | Server response time, compression, HTTP/2 or HTTP/3, caching headers, page weight, image formats, sizes and lazy loading, render-blocking scripts, fonts, third-party requests, and Lighthouse lab metrics (LCP, CLS, TBT, FCP, Speed Index). |
| SEO | 25% | Title and meta description, headings, canonical tags, robots meta and robots.txt, XML sitemaps, structured data, Open Graph tags, hreflang, and crawl findings such as broken links, redirect chains, duplicate titles, thin pages and noindexed pages. |
| Accessibility | 15% | Page language, image alternative text, link and button names, form labels, heading order, zoom/viewport settings and the Lighthouse accessibility audits. |
| Best practices | 10% | Doctype and character set, favicon, deprecated or outdated software signals, console-visible problems detected by Lighthouse, and general web-platform hygiene. |
How is the score calculated?
Every category starts at 100. Each issue subtracts points according to its severity:
| Severity | Points | Typical example |
|---|---|---|
| Critical | 30 | Expired TLS certificate, site unreachable over HTTPS |
| High | 15 | No HTTPS redirect, very slow Largest Contentful Paint |
| Medium | 7 | Missing meta description, no HSTS header |
| Low | 2.5 | Missing favicon, a few unoptimised images |
| Info | 0 | Notes that do not affect the score |
Penalties are sorted from largest to smallest and each further issue counts 80% as much as the one before it. That diminishing scale means a long list of small problems cannot sink an otherwise healthy site, while one serious problem still shows. Any critical issue caps its category, and the overall score, at 49 (an F) until it is fixed.
How does Lighthouse affect the score?
When the Lighthouse test completes, its category score is blended with our own server-side checks:
| Category | Lighthouse share | Our checks |
|---|---|---|
| Performance | 70% | 30% |
| Accessibility | 60% | 40% |
| Best practices | 50% | 50% |
| SEO | 40% | 60% |
| Security | 0% | 100% |
If the Lighthouse run cannot finish (for example the page blocks headless browsers or takes too long), the report says so and uses our server-side checks alone.
What do the letter grades mean?
| Grade | Score |
|---|---|
| A+ | 95–100 |
| A | 90–94 |
| B | 80–89 |
| C | 70–79 |
| D | 60–69 |
| F | 0–59 |
How does the Lighthouse speed test work?
We run Google Lighthouse (version 12) against your homepage in headless Chrome on our own server. The mobile test is the default and uses Lighthouse’s standard mobile emulation and simulated throttling; you can choose a desktop test instead. Lab results vary a little between runs, test locations and network conditions, so treat a few points of difference as noise. Lighthouse results are cached for six hours per page and device.
Core Web Vitals thresholds follow Google’s published guidance: Largest Contentful Paint should be 2.5 seconds or less and Cumulative Layout Shift 0.1 or less. Interaction to Next Paint cannot be measured in a lab test, so we report Total Blocking Time as its lab stand-in.
How does the crawl work?
After the page you entered, we look for internal links on it and in your XML sitemap, then fetch up to 25 HTML pages on the same site, one at a time. While crawling we obey robots.txt rules for our user agent and any crawl-delay up to two seconds, skip login, cart, admin and feed URLs, and check up to 40 internal and 20 external link targets for errors.
Who is SuperSiteReportBot?
Our scanner identifies itself with this user agent:
Mozilla/5.0 (compatible; SuperSiteReportBot/3.0; +https://supersitereport.com/methodology/)
It only visits a site when someone requests a scan of it. A full scan makes a small number of requests: the page entered, robots.txt, sitemaps, up to 25 pages, link checks, and one Lighthouse page load. To stop our crawler visiting pages beyond the one entered, add this to your robots.txt:
User-agent: SuperSiteReportBot
Disallow: /For safety, the scanner refuses private, internal and reserved network addresses, re-checks every redirect, and limits response sizes and scan time.
What are the limitations?
- We test what a visitor sees from the public internet. Pages behind logins, firewalls or bot protection may be partly or wholly unavailable to us.
- Automated accessibility checks catch only some barriers; a manual review with assistive technology is still needed for full WCAG conformance.
- Results are cached for up to one hour, so very recent changes may not show until the cache expires.
- A good score is a sign of a well-maintained site, not a guarantee of search rankings or security.
Sources
- Lighthouse performance scoring (Chrome for Developers)
- Web Vitals (web.dev)
- OWASP Secure Headers Project
- WCAG overview (W3C WAI)
- SEO Starter Guide (Google Search Central)