How Many Security Headers Are You Actually Using?
A handful of HTTP response header settings can block a large share of attacks like XSS, clickjacking, and MIME sniffing. But knowing which header matters how much isn't obvious at a glance. This tool lets you check off which of six core security headers you've applied and returns a weighted score out of 100 along with a letter grade.
Weight by Header
| Header | Weight |
|---|---|
| Content-Security-Policy | 25 pts |
| Strict-Transport-Security | 20 pts |
| X-Content-Type-Options | 15 pts |
| X-Frame-Options | 15 pts |
| Referrer-Policy | 15 pts |
| Permissions-Policy | 10 pts |
Headers Are Only Part of the Defense
Security headers strengthen the browser-level defense layer, but they don't protect against application-level flaws like SQL injection or broken authentication logic. Even with a high score, regular code review and dependency vulnerability scanning are still necessary.
Frequently Asked Questions
Six key security headers, including CSP and HSTS, each carry a weight. The weights of the headers you've applied are summed to a 100-point score.
Content-Security-Policy is the primary defense against script-injection attacks like XSS, covering a broad range of attack vectors.
A lower score does mean fewer defensive layers, but real risk depends just as much on vulnerabilities in your application logic.