Security Headers Grader
Grade any site's HTTP security headers: HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy. Free A–F score.
Frequently asked
What's a good score?
Aim for A (90+). CSP and HSTS carry the most weight because they block the highest-impact attacks (XSS and protocol downgrade).
Will adding these headers break my site?
HSTS and a strict CSP can, if misconfigured. Roll out CSP in report-only mode first, then enforce.