Skip to content
ENExplore Calculators

HTTP Security Score Calculator

Combine transport, headers, cookies and configuration hygiene into one HTTP security score and find the weakest pillar.

About HTTP Security Score Calculator

The four pillars are weighted by how directly each one prevents an attack: transport and headers stop interception and injection, cookies limit what a session compromise yields, and hygiene covers the misconfigurations that hand an attacker a free reconnaissance pass. Each pillar is normalised so the weakest one is visible rather than averaged away. A single composite score is what gets reported upward, but the pillar breakdown is what tells the engineer which morning's work moves it.

Formula

HTTP Security Score

HTTP score = transport (30: redirect + HSTS + TLS version) + headers (25 × your header score) + cookies (20 × your cookie score) + hygiene (25: 8 no mixed content, 6 no verbose errors, 6 no unsafe methods, 5 no directory listing) = 100.

transport
Whether the connection is encrypted and stays encrypted
hygiene
Configuration mistakes that leak information or accept unsafe requests

Worked example

With the default values below, HTTP Security Score Calculator returns HTTP Security Score of 81. Change any input above and every figure here is recalculated in your browser.

Inputs used

HTTP to HTTPS redirectone of 301 to HTTPS on every host — 10, Most hosts redirect — 6, No redirect — 0
301 to HTTPS on every host — 10
HSTS max-ageaccepts 0–63,072,000 seconds
31,536,000 seconds
Lowest TLS version acceptedone of TLS 1.3 only — 10, TLS 1.2 and 1.3 — 8, TLS 1.1 accepted — 3, TLS 1.0 or older accepted — 0
TLS 1.2 and 1.3 — 8
Security header scoreaccepts 0–100 %
70 %
Cookie flag scoreaccepts 0–100 %
80 %
Mixed content present on HTTPS pages
No
Stack traces or version banners in responses
Yes
TRACE, PUT or DELETE reachable without authorisation
No
Directory listing or source files reachable
No

Results

HTTP Security Score
81 / 100
Overall Grade
B — Good
Transport Pillar
28.0 / 30
Hygiene Pillar
19 / 25
Weakest Pillar
Security headers
Highest-Value Fix
Stop returning stack traces and version banners

Step by step

  1. 1Values used
  2. 2HTTP Security Score
  3. 3HTTP Security Score= 81 / 100
  4. 4Overall Grade= B — Good
  5. 5Transport Pillar= 28.0 / 30
  6. 6Hygiene Pillar= 19 / 25
  7. 7Weakest Pillar= Security headers
  8. 8Highest-Value Fix= Stop returning stack traces and version banners

Assumptions and limits

  • The result is derived only from the 9 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax or compounding frequency into account.
  • Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is HTTP Security Score calculated?

HTTP score = transport (30: redirect + HSTS + TLS version) + headers (25 × your header score) + cookies (20 × your cookie score) + hygiene (25: 8 no mixed content, 6 no verbose errors, 6 no unsafe methods, 5 no directory listing) = 100. The four pillars are weighted by how directly each one prevents an attack: transport and headers stop interception and injection, cookies limit what a session compromise yields, and hygiene covers the misconfigurations that hand an attacker a free reconnaissance pass. Each pillar is normalised so the weakest one is visible rather than averaged away.

Why does HTTP Security Score matter?

A single composite score is what gets reported upward, but the pillar breakdown is what tells the engineer which morning's work moves it.

What values do I need to enter?

This calculator takes 9 inputs: HTTP to HTTPS redirect, HSTS max-age, Lowest TLS version accepted, Security header score, Cookie flag score, Mixed content present on HTTPS pages, Stack traces or version banners in responses, TRACE, PUT or DELETE reachable without authorisation, Directory listing or source files reachable. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why does verbose error output matter if nothing is exploitable?

Because it removes the attacker's guesswork. Stack traces name your framework, ORM and file paths; version banners map straight to a CVE list. Neither is a vulnerability on its own, and both shorten the reconnaissance phase from days to minutes.

Related Calculators

HTTP Security Score Calculator | Calcrivo