What the security headers checker grades
The tool fetches your page, follows redirects, and reads eight HTTP response headers that tell browsers how to protect your visitors: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy.
Each header earns points according to its weight and how it is configured, and the total is shown as a share of the maximum. A fully hardened site scores 100 and gets an A+.
Where the points come from
Content-Security-Policy weighs the most: 25 points, or 15 if it still allows unsafe-inline or unsafe-eval. Strict-Transport-Security is worth 20 points with a max-age of at least a year and the preload flag. X-Frame-Options and X-Content-Type-Options are worth 10 each, and the four others 5 each.
Each line of the result shows the points earned out of the points available, with a note on what to change.
Frequently asked questions
How do I get an A+ on the security headers test?
Send all eight headers with strict values: a CSP without unsafe-inline or unsafe-eval, HSTS with max-age=31536000 and preload, X-Frame-Options DENY or SAMEORIGIN, X-Content-Type-Options nosniff, a restrictive Referrer-Policy, a Permissions-Policy that disables unused features, and same-origin COOP and CORP.
Why is unsafe-inline in my CSP marked down?
unsafe-inline lets any inline script run, which is exactly what a cross-site scripting attack injects. Move inline scripts to files or allow them with nonces or hashes, then remove unsafe-inline.
Should I add my site to the HSTS preload list?
Only if every subdomain is served over HTTPS for good. Once preloaded, browsers refuse plain HTTP for the whole domain, and removal from the list takes months.
Where do I set these headers?
In your web server or CDN configuration: add_header in nginx, Header set in Apache, the headers file or rules of your host or CDN, or a middleware in your application.