Security Headers
Grade a site's HTTP security headers
Six response headers do most of the work of hardening a site in the browser. This checks which ones you send, grades the result, and gives the exact header to add for each one you are missing. Headers that leak your software versions cost you points too.
Frequently asked questions
Which header matters most?
Strict-Transport-Security and Content-Security-Policy. HSTS stops a downgrade to HTTP, and a CSP is the main defence against injected scripts. The rest are cheap wins worth doing anyway.
Will a CSP break my site?
It can, which is why you start with Content-Security-Policy-Report-Only. That reports what would have been blocked without blocking anything, so you can fix the reports before enforcing.
Why lose points for a Server header?
A version number tells an attacker exactly which exploits to try. Strip the version, or the header entirely — it does nothing for visitors.