What this tool checks
HTTP security headers tell the browser how to protect your users. This scanner grades the ones that matter most: HSTS to enforce HTTPS, Content-Security-Policy to limit what can run on the page, X-Frame-Options to block clickjacking, X-Content-Type-Options to stop MIME sniffing, Referrer-Policy, Permissions-Policy, and more. Each check shows the value it found, why it matters, and the exact header to add when something is missing.
How the grade is calculated
Each header is worth a set number of points based on how much protection it adds, with Content-Security-Policy and HSTS carrying the most and the rest filling in the remainder. Your grade is the percentage of the total achievable points you earn, so a fully modern configuration can reach the top instead of being blocked by any single unavoidable deduction. The bands are A+ at 95% or above, A at 85%, B at 70%, C at 55%, D at 35%, and F below that. Partially-configured headers earn partial credit (for example a CSP that still allows unsafe-inline scores lower than a strict one), which is why tightening an existing header, not just adding new ones, can move you up a grade.
Frequently asked questions
Which header should I fix first?
Start with HSTS and Content-Security-Policy. They carry the most weight and close the biggest gaps. The scorecard orders each check by impact so you can work down the list.
Will adding these headers break my site?
Most are safe to add immediately. Content-Security-Policy needs care because a strict policy can block scripts and styles you rely on, so roll it out in report-only mode first and tighten from there.
What is a good grade?
An A or A+ means the important headers are present and well configured. A C or below usually means HSTS or CSP is missing. The recommendations show precisely what to add to move up.