What are HTTP security headers?
HTTP security headers are instructions a web server sends with each page that tell the browser to switch on built-in protections: always use HTTPS, refuse to be embedded in another site, only run scripts from approved sources. They cost nothing to add and block whole classes of attack.
The headers this tool checks
| Header | What it does | Weight |
|---|---|---|
Strict-Transport-Security | Forces browsers to use HTTPS for every future visit (HSTS). | 25 |
Content-Security-Policy | Limits where scripts, styles and frames may load from. The main defense against cross-site scripting. | 25 |
X-Frame-Options | Stops other sites framing your pages (clickjacking). A CSP frame-ancestors directive counts too. | 15 |
X-Content-Type-Options | nosniff stops browsers guessing a file's type and running it as script. | 15 |
Referrer-Policy | Controls how much of your URL is passed to other sites. | 10 |
Permissions-Policy | Switches off browser features the site does not use, such as camera or geolocation. | 10 |
The grade is the total: A is 90 or more, B 75, C 55, D 35, and F below that. A site that does not serve HTTPS at all is capped at F.
The tool also reports two things that do not affect the grade: whether plain HTTP redirects to HTTPS, and whether the Server or X-Powered-By headers reveal software versions.
How to read the results
- HSTS with a short max-age gets partial credit. Six months (15552000 seconds) is the minimum that counts; one year is the usual target.
- A CSP that allows
'unsafe-inline'scripts without a nonce or hash is noted, because inline script is exactly what an injection attack uses. - A Report-Only CSP is reported as not enforced. It collects violations but blocks nothing.
- X-XSS-Protection is not graded. Modern browsers removed the feature it controlled, and setting it can introduce problems of its own.
The check makes one request to the site's home page, follows up to five redirects and reads only the response headers. It identifies itself as NetworkAIBot. Other pages on the same site may send different headers.
How to add the missing headers
After a scan, the result shows ready-made configuration for exactly the headers your site lacks. The general pattern on each platform:
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "DENY"
Header always set Referrer-Policy "strict-origin-when-cross-origin"Four of the six are safe to add to almost any site in one step. Two need care:
- HSTS is hard to undo. Once a browser has seen it, it refuses plain HTTP for the whole max-age. Confirm every subdomain works over HTTPS before adding
includeSubDomains, and start with a short max-age. - Content-Security-Policy can break a site, because it blocks any script or style it does not explicitly allow. Deploy it first as
Content-Security-Policy-Report-Only, fix what it reports, then enforce it.
What a good header set looks like
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()This is a strict baseline for a site that loads everything from its own origin. Most real sites need extra CSP sources for analytics, fonts or a CDN. HSTS is specified in RFC 6797, and the OWASP Secure Headers Project keeps current guidance on each header.