Security Headers

Security headers are instructions a server attaches to an HTTP response telling the browser which protections to enforce for that page. They cost nothing at runtime, but they only work in browsers and only when delivered as real response headers; a CSP placed in a meta tag, for example, ignores frame-ancestors and reporting directives, and HSTS or X-Frame-Options in meta tags are ignored entirely.

Strict-Transport-Security (HSTS, RFC 6797) tells the browser to use HTTPS only for the host for max-age seconds, turning a mistyped http:// link or a downgrade attempt on hostile Wi-Fi into an automatic HTTPS request. A typical value is 'max-age=31536000; includeSubDomains'. Adding 'preload' and submitting the domain to the browser preload list protects even the very first visit, but the list requires a valid certificate, an HTTP-to-HTTPS redirect on the same host, HTTPS on every subdomain, includeSubDomains and a max-age of at least one year, and removal takes months.

Content-Security-Policy (CSP Level 3, W3C) restricts where scripts, styles, images, frames and connections may load from. A policy such as "default-src 'self'; script-src 'self' 'nonce-r4nd0m' 'strict-dynamic'; object-src 'none'; base-uri 'none'; frame-ancestors 'self'" blocks most injected scripts, whereas policies that allow 'unsafe-inline' or broad schemes like https: offer little XSS protection. The frame-ancestors directive is the modern replacement for X-Frame-Options (RFC 7034), which only supports DENY and SAMEORIGIN; browsers that understand frame-ancestors give it precedence, but sending both remains common for older clients and scanners.

Several smaller headers close specific gaps. X-Content-Type-Options: nosniff stops browsers from guessing MIME types, so an uploaded text file cannot be executed as script. Referrer-Policy controls how much of the URL leaks to other sites; strict-origin-when-cross-origin, the default in current browsers, sends only the origin cross-site. Permissions-Policy (the successor to Feature-Policy) disables powerful features such as camera=(), microphone=() or geolocation=() for the page and its iframes. Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy and Cross-Origin-Resource-Policy isolate the page from other origins and are required for features like SharedArrayBuffer. X-XSS-Protection, by contrast, controlled a filter that modern browsers removed and that could itself be abused, so current guidance is to omit it or send 0.

This tool requests the URL, following up to five redirects, and requires a successful 2xx response. On HTTPS URLs a missing HSTS header is a critical issue, and max-age below 31536000 is a warning. CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy (or legacy Feature-Policy) each produce a warning when absent. COOP, COEP and CORP count as bonus passes. The grade is the share of passed checks out of seven: A from 90 percent, then B, C and D in ten-point steps, and F below 60 percent.