How the grade is calculated
Each header earns points according to its importance. If a header is present but weakly configured, it earns half.
| Header | Points | Protects against |
|---|---|---|
Strict-Transport-Security | 25 | Downgrades to unencrypted connections |
Content-Security-Policy | 25 | Injected malicious code (cross-site scripting) |
X-Frame-Options | 15 | Invisible framing (clickjacking) |
X-Content-Type-Options | 15 | Misinterpreted files |
Referrer-Policy | 10 | Leaking sensitive addresses |
Permissions-Policy | 10 | Unwanted access to camera, microphone and location |
90 points or more earn an A, 75 a B, 55 a C, 35 a D, 15 an E, and anything below an F.
A poor grade does not mean you have been hacked
The headers are an extra layer of protection. If they are missing, the website is not automatically insecure, but attacks become easier. Many large websites do not have a perfect grade either. For small business websites, HSTS, X-Content-Type-Options and X-Frame-Options take only a few lines of configuration.
What each header does and how to set it up on Apache, Nginx or WordPress: Security headers explained.
Frequently asked questions: Security Headers Check
What are security headers?
Security headers are instructions your web server sends to the browser with every page. They protect visitors against common attacks such as clickjacking, injected code or being downgraded to an unencrypted connection.
Which security headers should every website have?
At least Strict-Transport-Security (HSTS), X-Content-Type-Options, X-Frame-Options or frame-ancestors, and a Referrer-Policy. A Content-Security-Policy gives the strongest protection but takes more effort to set up.
How do I get an A in the security headers check?
Set all six headers we check, including a Content-Security-Policy without unsafe-inline. Ready-to-copy lines for Apache, Nginx and WordPress are in our guide “Security headers explained”.