Grade a response

A web page cannot read another site's response headers (the browser's CORS rules forbid it), so this tool works on pasted headers. Nothing is fetched and nothing is sent anywhere: the page has no network access at all (its CSP says connect-src 'none').

Step 1: domain (optional) fills in the command below

curl -sI https://example.com

curl -sIL https://example.com

Run it in a terminal. The second form follows redirects; the last response is the one graded. Or open your browser dev tools, Network tab, pick the document request and copy its response headers.

Same domain, other tools:

Step 2: paste the response headers HTTP/1.1 or HTTP/2, status line optional

Sensitive page (logged-in or personal data): require Cache-Control: no-store Or load a sample (invented headers for example.org, not a real site)

Paste headers and press "Grade headers" (or Ctrl+Enter).
Assumes the response was served over HTTPS. The score is a weighted heuristic, not an audit.

Recommended header set

Pick your options and copy the snippet for your server. Test in a staging environment first: a strict CSP or COEP can break pages that load third-party scripts, styles or embeds.

Format

Content-Security-Policy edit to fit your site; the checks below update as you type

HSTS max-age

includeSubDomains (only if every subdomain serves HTTPS) preload (a long-term commitment: read hstspreload.org first) Cross-Origin-Embedder-Policy: require-corp (breaks cross-origin embeds without CORS/CORP)

Referrer-Policy

X-Frame-Options (legacy fallback for frame-ancestors)

Cross-Origin-Resource-Policy

Snippet

Not generated because they depend on the page: Cache-Control (use no-store on logged-in pages) and Set-Cookie flags (set in your application: __Host-name=...; Path=/; Secure; HttpOnly; SameSite=Lax).

How the grade works

It is a heuristic. Each check is scored 0 to 1 and weighted (CSP 25, HSTS 15, clickjacking 7, cookies 10, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and information leaks 5 each, COOP 4, COEP and CORP 2 each, Cache-Control 5 when the page is marked sensitive). Checks that do not apply, such as cookies when none are set, are left out of the total. The total maps to A+ (95 and up), A (85), B (70), C (55), D (40), E (25) and F. A missing CSP or HSTS caps the grade at B, and A+ needs a clean enforced CSP plus a one-year HSTS with includeSubDomains.

What it cannot know. It sees one response only. It cannot tell whether HTTPS is enforced on every URL, whether a CSP breaks your site, whether your cookies are the ones that matter, or what other pages send. Headers also differ between pages, redirects and static assets. Reports with a different weighting, such as Mozilla Observatory or securityheaders.com, will give different letters.

Privacy. Pasted text is parsed in your browser and discarded when you close the tab. There are no analytics, no cookies and no requests to any server (see the CSP of this page).