HTTP header checker

How the 100 points are split

Seven checks, graded on the final response only. HSTS and CSP carry half the score because they block the attacks that actually happen to ordinary sites: downgrade to HTTP on public Wi-Fi, and injected script. The rest are one-line headers with no reason to be missing.

Grades: A is 90 to 100, B is 75 to 89, C is 60 to 74, D is 45 to 59, F is under 45. A final page served over plain HTTP gets an F whatever the points say, because every other header can be stripped in transit.

Worked example: a C that becomes an A

A typical shop on Express behind a CDN returns this:

HTTP/2 200
strict-transport-security: max-age=15552000
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://www.googletagmanager.com
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
set-cookie: session=[redacted]; Path=/; Secure; HttpOnly
x-powered-by: Express

That is 63 points, a C. The X-Powered-By line costs nothing but shows up as a note. Five changes take it to 100:

• max-age=31536000; includeSubDomains (+10)
• Swap 'unsafe-inline' for a per-request nonce, and add object-src 'none'; base-uri 'self' (+13)
• Referrer-Policy: strict-origin-when-cross-origin (+5)
• Permissions-Policy: camera=(), microphone=(), geolocation=() (+5)
• SameSite=Lax on the session cookie (+4)

Paste both versions into Grade pasted headers to watch the score move. The nonce is the only change that needs code; everything else is config.

Reading the redirect hops

The hop table lists every response in order: its status code, the URL that was requested, and where the Location header pointed. Each redirect hop's own headers sit in a collapsed block under the final header list. For longer chains, loops and www or http mix-ups, the redirect chain checker follows up to 10 hops and says which ones to collapse.

• http:// to https:// with a 301 or 308, then a 200, is the normal setup. A 302 there works but tells caches and crawlers the move is temporary.
• HSTS sent on a plain HTTP hop is ignored by browsers. It only counts on HTTPS responses.
• HSTS sent by an earlier HTTPS hop on the same host still counts in browsers, but this grade looks only at the final response. If you set HSTS at the redirect layer only, open that hop's headers before trusting the score.
• After 5 redirects the check stops and shows the chain so far.

Flagged but not scored

These show up as notes under the grade. They are worth fixing, or worth knowing, but they do not change the letter:

• X-Powered-By at any value, and a Server header that includes a version number.
• X-XSS-Protection set to anything except 0.
• Access-Control-Allow-Origin: *, which lets any site read the response with fetch().
• Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy and Cross-Origin-Resource-Policy are listed when present, since they matter for cross-origin isolation, not for a basic grade.
• Cookies without HttpOnly are named in the cookie row. That flag is right for session cookies and wrong for cookies your own JavaScript reads, so it is not scored.

Setting the headers on Nginx, Apache and _headers files

Ship CSP as Content-Security-Policy-Report-Only first if you have inline scripts or third-party tags. A strict policy will break them, and Report-Only tells you where.

Nginx. Use always so the headers are also sent on 4xx and 5xx responses. An add_header inside a location block replaces every add_header inherited from the server block, so repeat them there or keep them all at one level.

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header Content-Security-Policy "default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

Apache with mod_headers:

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header always set Content-Security-Policy "default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"
Header always set X-Content-Type-Options "nosniff"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
Header unset X-Powered-By

A _headers file (Cloudflare Pages, Netlify) at the root of the build output. On Cloudflare Pages these rules apply to static files, not to responses from Pages Functions, which have to set their own headers.

/*
  Strict-Transport-Security: max-age=31536000; includeSubDomains
  Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'
  X-Content-Type-Options: nosniff
  Referrer-Policy: strict-origin-when-cross-origin
  Permissions-Policy: camera=(), microphone=(), geolocation=()

Add cookie flags where the cookie is created, in your framework or session middleware, not in the web server.

Where this check can be wrong

• One request, from a Cloudflare datacenter, as ToolPetalBot, with no cookies. Bot rules, WAF challenges, geo rules, A/B tests and logged-in pages can all return different headers than your browser gets. A 403 or challenge page usually means the site blocked the bot, and its headers are the block page's.
• Only the final response is graded. Images, scripts and API routes on the same site can send different headers; check them by URL one at a time.
• The CSP check is shallow. It reads script-src or default-src for 'unsafe-inline', 'unsafe-eval' and wide sources, reads frame-ancestors, and notes a missing object-src or base-uri. It does not judge host allowlists (a whitelisted CDN can still host a bypass), style-src, reporting directives or a CSP set in a meta tag.
• The body is never read, so nothing set in HTML meta tags is seen, and cookies set by JavaScript are invisible.
• HSTS preload list membership is not checked, and includeSubDomains is noted but not scored.
• Public hosts on ports 80 and 443 only, 5 redirects, 8 seconds, 20 checks per minute. Up to 100 headers per response are shown; values longer than 8192 characters are cut.
• The weights are ToolPetal's own. Other graders score differently, and none of them is a security audit.

FAQ