A vendor-neutral, open standard for measuring DDoS resilience. One score, six components, fully transparent methodology.
Each component is scored 0-100 independently, then combined using fixed weights.
CDN deployment, WAF presence, origin protection, rate limiting, and vendor automation capability.
HTTP floods, Slowloris, cache bypass, API abuse resistance. Penalized for exposed GraphQL introspection, missing rate limiting, XMLRPC amplification vectors, and large uncacheable API surfaces. v1.1: L7 Attack Surface Assessment
SYN/UDP floods, amplification attacks, scrubbing center quality, and pipeline capacity.
HTTP/2 Rapid Reset, CONTINUATION Flood, QUIC Initial Flood, and protocol-specific CVEs.
Availability under attack, latency degradation, false positive rate, and recovery time.
JA3/JA4 fingerprint detection, slow-rate attacks, IP rotation handling, and behavioral analysis.
OPI accuracy depends on available data. Each tier is clearly labeled in reports.
| OPI Passive | DNS + HTTP headers only. Infrastructure coverage estimate. No active testing. |
| OPI Estimated | Passive + L7 recon (API surface, GraphQL, rate limiting detection) + client data. Pre-test estimate with L7 attack surface penalties. |
| OPI Validated | Post active test. Measured availability, latency, error rates under real attack simulation. Authoritative score. |
Define your infrastructure to compute an OPI score using the same engine as DDactic scans.
| Score | Grade | Classification |
|---|---|---|
| 90 - 100 | A | Excellent - Enterprise-grade protection |
| 80 - 89 | B | Good - Solid defenses with minor gaps |
| 70 - 79 | C | Adequate - Basic protection, some risks |
| 60 - 69 | D | Poor - Major vulnerabilities present |
| 0 - 59 | F | Critical - Minimal to no protection |
Display your OPI score in READMEs, reports, and dashboards.
-16a34a){kind=icon}
Grade A
-2563eb){kind=icon}
Grade B
-d97706){kind=icon}
Grade C
-ea580c){kind=icon}
Grade D
-dc2626){kind=icon}
Grade F
Markdown
HTML