Reading a report

Every check produces a grade, a score out of 100, and a list of individual checks that passed, warned or failed.

The score

Each check carries a weight, because they are not equally important. Publishing private key material in a public profile is not the same size of mistake as an unexpected Content-Type.

The score is the weighted proportion earned, where a warning counts as half a pass.

The grade, and why it is not just the score

A failed check is a violation of something the specification says you MUST do. So a failure caps your grade regardless of how good the score is:

The score maps to a grade in the usual way — 90+ is an A, 80+ a B, and so on — and whichever of the two is worse wins.

A site can therefore score 95 and still grade B. A site that breaks a MUST should not receive an A on the strength of passing a larger number of minor checks.

Not detected is not grade F

A site with no integration scores 0 and grades N/A, not F.

An F would be a judgement on quality, and there is nothing to judge. Many sites have no reason to implement UCP, and reporting a publisher as having failed a commerce standard is not useful.

The transport checks that ran before the absence was established are also excluded. Scoring those alone would produce a perfect grade for a site that supports nothing.

Could not tell

If your origin rate limited us, timed out, or returned a server error, the report says could not tell and shows no grade.

This distinction matters throughout the product. A check that did not complete has found nothing wrong with the site, and reporting "no integration found" would tell an operator with a working integration that they have none. The state is therefore carried through reports, alerts and issues, where an inconclusive run changes nothing.

Every finding carries a fix

Each failing or warning check states the remedy and links the section of the specification it comes from.