Security header score
9 important HTTP security headers graded A-F.
How this tool works
The security header score grades ten checks and returns a grade from A+ to F. It evaluates HSTS (with weighting of the max-age value), CSP (with a penalty when unsafe-inline takes effect for scripts or unsafe-eval is allowed), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP (Cross-Origin-Opener-Policy), COEP (Cross-Origin-Embedder-Policy), CORP (Cross-Origin-Resource-Policy) and the Server or X-Powered-By header (reveals version leak). Each check has a weight; HSTS and CSP count most because they offer the strongest protection.
Typical use cases
- Before a pentest, document where you stand — A or B should be baseline
- For compliance audits (ISO 27001, BSI), use the score snapshot as evidence
- After CSP hardening, verify the new policy is delivered correctly
- In an agency, regularly screen client sites
Frequently asked questions
How is the A-F grade computed?
Weighted score: CSP 25%, HSTS 20%, X-Frame-Options and X-Content-Type-Options 10% each, Referrer-Policy and Permissions-Policy 8% each, COOP 7%, COEP 5%, CORP 4%, server leak 3%. From 95% A+, from 85% A, from 70% B, from 50% C, from 25% D, otherwise F.
Why only B despite having a CSP?
The CSP is graded in steps: if unsafe-inline takes effect for scripts, that costs 0.25 of 1.0, unsafe-eval 0.2, a missing default-src 0.25, missing frame-ancestors 0.1 and missing base-uri 0.05. If unsafe-inline sits next to a nonce, a hash or strict-dynamic, current browsers ignore it - that costs nothing. A B usually only results together with the other headers.
How is this different from the HTTP header inspector?
The header inspector shows ALL response headers. The security score focuses on the 9 security-relevant ones and grades them. Complementary — use both.
Why does the server header only score 0.7?
If the Server or X-Powered-By header names only the software (e.g. "nginx"), that gives 0.7 points; if it also reveals the version (e.g. "nginx/1.18"), only 0.3. If both headers are missing, you get 1.0 points.
Does the tool follow redirects?
Yes, up to 5 hops. The final response is graded — for HTTP→HTTPS redirects that means the production destination headers.
Related tools
Continuous monitoring vs. one-shot?
XICTRAQ monitors uptime, SSL, security headers, GDPR and performance 24/7. Free plan, no credit card.