How we calculate the Security Headers Checker
What it measures
Whether a site sends six security-relevant HTTP response headers, weighted and graded A–F.
How it works
- 1The tool requests the URL directly and reads the real HTTP response headers sent back.
- 2Six headers are checked, each weighted differently: Content-Security-Policy (25 points), HSTS (20), X-Content-Type-Options (15), X-Frame-Options or an equivalent frame-ancestors CSP directive (15), Permissions-Policy (15), and Referrer-Policy (10).
- 3Points for present headers sum to a score out of 100: A at 90+, B at 75+, C at 55+, D at 30+, F below that.
Real limitations
- This checks header presence, not header configuration quality — a present-but-misconfigured CSP still scores as present.
- Missing headers don't necessarily mean a site is insecure overall; this is one signal among many.