HTTP Headers: HSTS, CSP, XFO grade

HTTP security header test

Score HTTP security headers (HSTS, CSP, XFO…).

HTTP security headers

Gaps lower the letter grade. Falls back to GET if HEAD is missing; redirects never hit private nets.

Header	Protects against	Good example
`Strict-Transport-Security`	Forces HTTPS	max-age=31536000; includeSubDomains
`Content-Security-Policy`	Narrows XSS surface	default-src 'self'
`X-Frame-Options`	Clickjacking	DENY or SAMEORIGIN
`X-Content-Type-Options`	MIME sniffing	nosniff
`Referrer-Policy`	Referrer leakage	strict-origin-when-cross-origin
`Permissions-Policy`	Browser APIs	camera=(), geolocation=()

HTTP security header check

Missing hardening headers lower the grade. No CSP hurts XSS scoring the most. This is a config guide, not a pentest or WAF test.

Use a public hostname. Redirects are SSRF-filtered away from private networks.

Examples

Frequently asked questions

Why is the grade low without CSP?

CSP is the strongest XSS-related header. Its absence drops the score a lot.

Why is the grade low without HTTPS?

Most of these headers only make sense on HTTPS. Certificate first, then headers.

Is X-Powered-By bad?

It leaks the stack. Removing it reduces disclosure; it affects the grade a little.

Are redirects followed?

Only same-host public URLs. Private-network IPs are not followed.

How do I get an A+?

HSTS, a tight CSP, nosniff, Referrer-Policy and frame controls together. Not every site needs A+.