Security Headers Grader

The Security Headers Grader fetches any URL and grades the response's HTTP security headers on an A+ to F scale. It's the fastest way to answer a question every developer, SRE, and security engineer eventually asks: 'is this site's HTTPS configuration actually hardened, or are we just relying on TLS to save us?' The grade rolls up individual per-header scores for HSTS, Content-Security-Policy, X-Frame-Options / frame-ancestors, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, and Cross-Origin-Embedder-Policy.

Each header check reports whether it is present, how it is configured, and a human-readable note explaining what a browser will do with the current value. We also surface disclosure headers (Server, X-Powered-By) and cookie count, because leaking your web-server version or framework fingerprint is a small but real recon gift to attackers. The report is dense enough for a security review yet friendly enough to hand to a developer with no security background.

Use the grader as part of a launch checklist, before a penetration test, when migrating a site behind a new CDN or WAF, or to prove regression when a header goes missing. It complements our CSP Evaluator (which dives deep into a single Content-Security-Policy value) and our SSL Checker (which grades the TLS layer beneath the headers).