# Security Headers Grader

Grade the security headers a website sends, from HSTS and Content-Security-Policy to Referrer-Policy, with what each header does and the exact line to add.

Canonical: https://tamperbox.dev/security-headers

Reviewed: 2026-10-16

## Capabilities and processing

Enter a web address, or paste response headers such as the output of `curl -I`. For an address, our server requests the page, follows up to 10 redirects and returns the response headers, with cookie values removed. Pasted headers are graded in your browser.

Six headers count toward the grade: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options or CSP frame-ancestors, Referrer-Policy and Permissions-Policy. Each scores a point when it does its job, half a point when it is weak, and nothing when it is missing. 6 points is A, 5 is B, 4 is C, 3 is D, 2 is E and less is F; A+ also needs Cross-Origin-Opener-Policy and no header that names software versions. Every header gets a row with its value, what it means and the line to send instead, and the missing ones are written out for nginx, Apache, Caddy, a `_headers` file, IIS or Express.

## Example workflow

The sample shop scores D: HSTS for only six months, no Content-Security-Policy, a referrer policy that sends full addresses to other sites, no Permissions-Policy, and PHP naming its version. Break it removes headers, allows inline scripts, shortens HSTS, turns the policy to report-only or adds version headers, each built from your own headers when you entered some.

## Limits and interpretation

The final response after redirects is graded; other pages of the site may send different headers. The grade measures whether common protective headers are present and strong, not whether the site is secure. A suggested Content-Security-Policy starts in report-only mode because a working policy has to list the sources the site really uses. Nothing is stored.

## Related tools

[Redirect chain checker](https://tamperbox.dev/redirect-checker) · [Mixed content and cookie inspector](https://tamperbox.dev/mixed-content-checker) · [HTTP/3 and compression checker](https://tamperbox.dev/http3-checker) · [CORS tester](https://tamperbox.dev/cors-tester) · [All tools](https://tamperbox.dev/) · [Privacy](https://tamperbox.dev/privacy)