Question 1

What does the letter grade actually measure?

Accepted Answer

It measures how completely the response implements the OWASP Secure Headers baseline, weighted by impact. Strict-Transport-Security and Content-Security-Policy carry the most points because they close the largest attack classes (protocol downgrade and cross-site scripting). X-Content-Type-Options, clickjacking protection and Referrer-Policy follow, then Permissions-Policy, the cross-origin isolation trio and cookie flags. A pass earns full points, a weak-but-present header earns partial credit, and a missing one earns nothing. The score is the earned share of the maximum, mapped to letters: 95+ is A+, 85+ is A, 70+ is B, and below 40 is F. Because the weights are fixed, two sites — or the same site before and after a fix — can be compared meaningfully.

Question 2

How do I get my site's response headers to paste here?

Accepted Answer

Two easy ways. From any terminal: run curl -I https://your-site.com and copy the entire output, status line included — the parser tolerates it. From the browser: open DevTools, go to the Network tab, reload the page, click the first (document) request, open the Headers panel and copy everything under Response Headers. Either format works, and case doesn't matter. If you'd rather not copy anything, switch to fetch mode and this tool retrieves the headers through this site's own relay — no third-party service ever sees the URL.

Question 3

Is a missing Content-Security-Policy really that serious?

Accepted Answer

For any site that handles sessions, forms or user content — yes. CSP is the single most effective post-exploitation containment for cross-site scripting: even when an attacker finds an injection point, a strict policy stops the injected script from executing at all. The catch is that a lazy CSP gives almost no protection: script-src with 'unsafe-inline' or broad wildcards lets injected code run anyway. That's why this grader inspects the directives, not just the header's presence — it flags 'unsafe-inline', 'unsafe-eval', wildcard sources and missing object-src/base-uri/frame-ancestors, and gives partial credit accordingly.

Question 4

What is HSTS preload and should I enable it?

Accepted Answer

Strict-Transport-Security normally protects only after the browser's first visit — the very first request could still go over HTTP. Preload closes that gap: with max-age of at least one year (recommended two: 63072000), includeSubDomains, and the preload token, you can submit your domain to the list baked into Chrome, Firefox, Safari and Edge, so browsers never even attempt HTTP. Enable it once you're certain every subdomain serves HTTPS forever — removal from the preload list takes months. The grader gives full marks for the 180-day OWASP minimum and calls out the recommended two-year preload configuration in the fix text.

Question 5

Why does the grader tell me to REMOVE X-XSS-Protection?

Accepted Answer

Because the header is deprecated and was actively harmful. It controlled the legacy XSS auditors in old Chrome and Internet Explorer, which were removed years ago after researchers showed the auditor itself could be abused to introduce cross-site information leaks and even selectively disable legitimate scripts. Modern browsers ignore the header entirely, so it provides zero protection while signaling an unmaintained configuration. The modern replacement is a strict Content-Security-Policy. The same logic applies to Expect-CT, which became obsolete when Certificate Transparency enforcement was built into the platform.

Question 6

What are COOP, COEP and CORP, and do I need them?

Accepted Answer

They're the cross-origin isolation trio. Cross-Origin-Opener-Policy severs the window reference between your tab and pages that open it (or that it opens), killing a class of cross-window attacks like tab-nabbing and XS-Leaks. Cross-Origin-Embedder-Policy requires every embedded resource to opt in, and Cross-Origin-Resource-Policy is that opt-in signal. Together, COOP: same-origin plus COEP: require-corp make a page 'cross-origin isolated', which is required for SharedArrayBuffer and high-resolution timers. They're scored as informational here because strict values genuinely break some embedding scenarios — but COOP: same-origin alone is safe for most sites and worth adding.

Question 7

What cookie flags does the tool check?

Accepted Answer

Every Set-Cookie in the response is parsed for three flags. Secure ensures the cookie is never sent over plain HTTP — missing it on an HTTPS site means a network attacker can steal the session by forcing one insecure request. HttpOnly keeps the cookie out of JavaScript, so XSS can't simply read document.cookie and exfiltrate the session. SameSite (Lax or Strict) is the primary CSRF defense, controlling whether the cookie rides along on cross-site requests. The tool also flags SameSite=None without Secure, a combination browsers reject outright. Session cookies should carry all three; the fix is usually one attribute string in your framework's session config.

Question 8

Does fetching a live URL send my URL to any third party?

Accepted Answer

No. Fetch mode uses this site's own first-party relay — a small server route in the same deployment — because browsers cannot read response headers from arbitrary cross-origin sites (that's the Same-Origin Policy doing its job). The relay is hardened against misuse: it resolves DNS and refuses private and reserved addresses, follows at most ten redirects re-validating each hop, enforces timeouts and size caps, and logs status codes only, never bodies. If you'd rather involve no server at all, paste mode grades headers with zero network activity — it works offline.

Header	What it defends	Recommended value
Strict-Transport-Security	Forces every future visit over HTTPS — kills protocol-downgrade attacks.	`max-age=63072000; includeSubDomains; preload`
Content-Security-Policy	Whitelists what can execute — the strongest XSS containment a site can ship.	`default-src 'self'; script-src 'nonce-…'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'`
X-Content-Type-Options	Stops browsers MIME-sniffing responses into executable types.	`nosniff`
Frame ancestors / X-Frame-Options	Prevents your pages being framed for clickjacking overlays.	`frame-ancestors 'self' (CSP) or X-Frame-Options: DENY`
Referrer-Policy	Controls how much of the current URL leaks to other origins.	`strict-origin-when-cross-origin`
Permissions-Policy	Declares which powerful APIs (camera, mic, geolocation) the page may use.	`geolocation=(), camera=(), microphone=()`
COOP / COEP / CORP	Cross-origin isolation trio — unlocks SharedArrayBuffer, blocks cross-site leaks.	`same-origin / require-corp / same-origin`
Set-Cookie flags	Keeps session cookies off the wire and out of scripts.	`Secure; HttpOnly; SameSite=Lax`

Security Headers Grader

The OWASP secure-headers baseline

Why headers are the cheapest security you'll ever ship

Security Headers Grader FAQs

Trusted for Hardening Reviews

More of SEO Forge

Similar Calculators

SEO Audit Pro

SERP & Social Preview

Meta Tags Studio

Keyword Density & N-Grams

Readability Scorer

Robots.txt Studio

Often Used Together

Google Fonts Pairing Generator

Website Font Pairing Engine

Academic Research Paper Checker

Dominant Color Extractor

Related Articles

Technical Services