HTTP Security Headers Grader

HTTP security headers are response headers that instruct browsers to enable built-in security protections. They defend against XSS, clickjacking, MIME sniffing, and data leakage attacks. Unlike application-level fixes, security headers can be added in minutes and immediately improve your security posture. A missing Content-Security-Policy, for example, leaves you vulnerable to XSS attacks that could steal user data or session cookies.

CSP (Content-Security-Policy) tells browsers which sources of scripts, styles, images, and other resources are allowed to load on your page. It's the most powerful XSS defense available. Start with a report-only policy: Content-Security-Policy-Report-Only: default-src 'self'. Watch your browser console and report endpoint for violations. Gradually tighten until violations stop, then switch to enforcing mode. A strict CSP: default-src 'self'; script-src 'self' 'nonce-{random}'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:;

HSTS tells browsers to only connect to your site over HTTPS, even if users type http://. It prevents SSL stripping attacks and protocol downgrade attacks. After a browser sees HSTS, it will automatically upgrade HTTP requests to HTTPS for the duration of max-age. Include 'includeSubDomains' if all your subdomains support HTTPS. Use 'preload' only after you're confident HTTPS works perfectly — preload list entries are hard to remove. Start with max-age=300, then increase to 31536000 (1 year) once stable.

X-XSS-Protection is deprecated and should be disabled by setting it to 0. The browser's built-in XSS auditor (which this header controlled) has been removed from Chrome/Firefox. Worse, in some browsers it could actually introduce vulnerabilities by interfering with page rendering. Rely on Content-Security-Policy for XSS protection instead — it's far more comprehensive and modern.

Nginx: add headers in your server{} block with 'add_header Header-Name value always;'. Apache: use Header set or Header always set in .htaccess or httpd.conf. Express.js: use the helmet npm package — it sets most headers automatically with sensible defaults. Cloudflare: use Transform Rules or Workers to add headers. Vercel/Netlify: use headers in vercel.json or _headers file. Always test after adding headers as CSP especially can break functionality.