How the Scores Are Calculated, and What They Cannot See

Every point in a report is accounted for below. If a number here disagrees with what the engine does, the page is wrong and we want to know. The source of record is the tester itself, and this page is written from it rather than from memory.

What a test actually does

A test loads the page in a real Chromium browser from one of five regions, Cape Town, Frankfurt, St Louis, Singapore or Sydney, under a named network profile, and records what happened. It does a cold load, then a warm reload to observe caching, and captures screenshots and a video of the load. The desktop and mobile passes are separate loads at separate viewports.

The network profile is a condition, not a recommendation. A desktop test over LTE is a real thing that happens to real visitors, and it is measured that way rather than assumed away.

The four pillars, and what each is worth

The overall score is a weighted average of four directly measured pillars, rounded to a whole number:

overall = round(
    performance × 0.35
  + security    × 0.25
  + caching     × 0.20
  + seo         × 0.20
)

Accessibility is reported beside those four and is not part of the overall, for the reason given below. Nor is AI visibility.

Performance: 100 points, mobile-weighted 55/45

Mobile is weighted higher because Google indexes mobile-first. Each metric earns full points inside the good band, half points inside the "needs improvement" band, and nothing beyond it.

Mobile, 55 points: LCP 2.5 s / 4.0 s → 15 or 8; TBT 200 ms / 600 ms → 15 or 8; CLS 0.1 / 0.25 → 12 or 6; FCP 1.8 s / 3.0 s → 7 or 4; TTFB 800 ms / 1,800 ms → 6 or 3.

Desktop, 45 points: LCP → 12 or 7; TBT → 12 or 6; CLS → 10 or 5; FCP → 6 or 3; TTFB → 5 or 3, at the same thresholds.

Two modifiers: +4 when every image is served in a modern format, and −4 when third-party requests are more than 50 % of the page weight on either device. TBT carries as much weight as LCP on purpose: it is the lab proxy for INP, and a page that paints fast but janks is not a fast page.

Security: 100 points

A valid certificate is worth 16 and a chain that validates against public CAs a further 12, because a broken chain still loads in browsers but fails strict clients. Expiry earns 12 at 30 days or more, 6 at 7 days or more, and −30 when it has already expired or expires today.

HSTS is worth 14. CSP is worth 14, or 7 when the policy is report-only, or 5 for the deprecated X-XSS-Protection as a fallback. X-Frame-Options is 10, X-Content-Type-Options 8, an HTTP 200 response 8, and a CDN in front of a valid certificate 6 more. Report-only CSP earns half because it records violations and blocks nothing. Full credit would overstate it, and zero would punish the documented first step of a rollout.

Caching and delivery: 100 points

The share of static assets whose own Cache-Control asks to be cached is worth up to 65, Brotli 25 or gzip 18, and a cacheable document 10. A no-cache document is neutral, not a penalty: that is the correct setting for a page whose prices change.

When the warm reload could not measure asset cacheability, the pillar scores only what it did observe and is capped at 80. An unmeasured number is not a zero, and marking a site down for our own measurement failing would be a lie told in the site's direction.

SEO: 100 points, and deliberately shallow

Meta description 12 when present and within 70 to 160 characters, or 9 when present but out of band. Exactly one h1 earns 12, any valid JSON-LD 15, robots.txt 8, a sitemap 8, 300 words or more 5, and at least five internal links 5. Image alt coverage earns 12 at 90 % or better and 6 at 70 %. A complete Open Graph set earns 15 and a Twitter card 8. A meta keywords list longer than 15 terms costs 2, because every major engine ignores it and only Bing treats stuffing as a signal.

This is an overview, not an audit. It checks whether the basics exist, not whether the content deserves to rank: keyword targeting, internal-link structure, indexation and backlinks are the job of a dedicated crawl, and the paid product does that separately.

Accessibility: a separate score, on purpose

axe-core counts violations on the scanned page, each rule capped at ten nodes, weighted critical 5, serious 3, moderate 1.5, minor 0.5. The penalty goes through a decay curve, 100 × e^(−penalty / 60), rather than straight subtraction, because real pages average dozens of detectable issues and linear subtraction would pin almost every site at zero and leave no room to show improvement. A page going from 56 issues to 9 visibly climbs.

It is not part of the overall because it is not a trade against performance or security, and because automated checks find a fraction of what a person with a screen reader finds. It is null when no scan ran, which is different from zero and is reported as different.

AI visibility: its own 100 points

Whether assistants may read the site is scored separately. Agent access 40, content signals 15, llms.txt and llms-full.txt 20, sitemap and Link headers 15, markdown negotiation 10. Agent protocol files, among them MCP, A2A, auth.md, an API catalog and DNS-AID, are reported and never scored, because a site that publishes pages and no API is not failing at anything.

Fifteen agents are asked, not five, because "AI crawlers" is not one crawler and a list written for OpenAI and Anthropic blocks nobody else. The set is OpenAI (GPTBot for training, OAI-SearchBot for search, ChatGPT-User for browsing), Anthropic (ClaudeBot, Claude-User), Perplexity, Google (Google-Extended, its training control), Common Crawl, Apple (Applebot-Extended), Meta (Meta-ExternalAgent), and the four Chinese labs, ByteDance (Bytespider), DeepSeek (DeepSeekBot), Alibaba Qwen (QwenBot) and Moonshot Kimi (KimiBot for training, Kimi-User for browsing). Access is worth 40 points in proportion to how many of the fifteen may fetch the page, so blocking the Chinese agents costs the same as blocking the English ones.

What a single test cannot see

  • Real visitors. There is no field data here. Core Web Vitals on a real device with a real network is the only INP that counts, and this is a lab measurement of one request.
  • The rest of the site. A test measures a page. Uptime, trends and a second page are the monitoring product, not this.
  • Cache state. A cold TTFB includes the CDN warming a cache. Run the same test twice and the second is usually faster for reasons that belong to the edge, not the origin.
  • Blocked trackers. The browser refuses known analytics and beacon endpoints, so a third-party count describes what loaded, not what the site tried to load.
  • Anything about quality. Whether the writing is any good, whether the site deserves to rank, and whether anyone links to it are outside every number on this page.
  • Mobile usability beyond the viewport. The mobile pass is a small viewport, not a phone in a hand on a train.

One sample is one sample. A score that moves five points between runs on an unchanged site is measuring the network, and the report shows enough of the raw numbers that you can tell which kind of change you are looking at.

Run a Free Enterramon Test