The six headers we grade
- Strict-Transport-Security (HSTS). Tells browsers to use HTTPS for your domain for
max-ageseconds, even if someone types http://. Aim for one year (31536000) once HTTPS works everywhere. - Content-Security-Policy (CSP). Lists where scripts, styles, images and frames may load from. It’s the main defence if someone manages to inject a script. A policy that allows
'unsafe-inline'scripts gets partial credit, since inline injection still works. - X-Content-Type-Options: nosniff. Stops browsers guessing a file’s type, so an uploaded text file can’t be run as a script. One value, no downside.
- Frame protection. CSP
frame-ancestors(or the olderX-Frame-Options) controls who can load your pages in a frame, which blocks clickjacking. If both are set, modern browsers use frame-ancestors. - Referrer-Policy. Controls how much of your URL is sent to other sites when someone clicks a link.
strict-origin-when-cross-originsends only your domain to other sites and is the default in current browsers; setting it explicitly removes doubt. - Permissions-Policy. Switches off browser features you don’t use, such as the camera, microphone and geolocation, for your pages and any third-party scripts on them.
We also test whether http:// redirects to https://, and note deprecated or leaky headers like X-XSS-Protection or a Server header that reveals a version number.
Where to set them
Headers are set by whatever serves your pages: next.config.js headers or middleware in Next.js, a _headers file on Cloudflare Pages or Netlify, vercel.json on Vercel, or your nginx config. Add them in one place so every response gets them, including error pages.
Read the grade as a to-do list
The grade is a simple weighted checklist of the headers, not a security audit. A site can score A and still have a vulnerable plugin. Use it to catch missing basics, then fix things in order of the points missing. After a change, re-run the check and confirm redirects with the redirect checker.