HTTP Security Score Calculator

HTTP score = transport (30: redirect + HSTS + TLS version) + headers (25 × your header score) + cookies (20 × your cookie score) + hygiene (25: 8 no mixed content, 6 no verbose errors, 6 no unsafe methods, 5 no directory listing) = 100. The four pillars are weighted by how directly each one prevents an attack: transport and headers stop interception and injection, cookies limit what a session compromise yields, and hygiene covers the misconfigurations that hand an attacker a free reconnaissance pass. Each pillar is normalised so the weakest one is visible rather than averaged away.

A single composite score is what gets reported upward, but the pillar breakdown is what tells the engineer which morning's work moves it.

This calculator takes 9 inputs: HTTP to HTTPS redirect, HSTS max-age, Lowest TLS version accepted, Security header score, Cookie flag score, Mixed content present on HTTPS pages, Stack traces or version banners in responses, TRACE, PUT or DELETE reachable without authorisation, Directory listing or source files reachable. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Because it removes the attacker's guesswork. Stack traces name your framework, ORM and file paths; version banners map straight to a CVE list. Neither is a vulnerability on its own, and both shorten the reconnaissance phase from days to minutes.