Security Header Score Calculator
Grade your HTTP security headers with weighted scoring, including whether HSTS max-age clears the one-year preload bar.
About Security Header Score Calculator
CSP and HSTS take 45 of the 100 points because they are the only two headers that stop an attack class outright rather than trimming an edge. HSTS is scored on a curve: anything below one year fails the preload requirement, and includeSubDomains only counts once a policy is actually being sent. Headers are the cheapest security work available — a single response filter — and the score is what an external observer, including your customer's security questionnaire, will see.
Formula
Security Header Score
Header score = CSP (25 strict, 12 with unsafe-inline, 5 Report-Only) + HSTS (14 at max-age ≥ 31536000, 10 at ≥ 15552000, plus 4 includeSubDomains and 2 preload) + 10 framing + 8 nosniff + 8 Referrer-Policy + 7 Permissions-Policy + 7 COOP + 5 CORP + 5 Cache-Control + 5 banner removal = 100.
- max-age ≥ 31536000
- One year, the minimum for the preload list
- COOP
- Cross-Origin-Opener-Policy, which isolates the browsing context
Worked example
With the default values below, Security Header Score Calculator returns Header Score of 57. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Content-Security-Policyone of Strict policy, no unsafe-inline — 25, Allow-list with unsafe-inline — 12, Report-Only — 5, Absent — 0
- Allow-list with unsafe-inline — 12
- HSTS max-ageaccepts 0–63,072,000 seconds
- 15,552,000 seconds
- HSTS includeSubDomains
- Yes
- HSTS preload
- No
- Framing blocked by frame-ancestors or X-Frame-Options
- Yes
- X-Content-Type-Options: nosniff
- Yes
- Referrer-Policy set to a private value
- Yes
- Permissions-Policy restricts powerful features
- No
- Cross-Origin-Opener-Policy: same-origin
- No
- Cross-Origin-Resource-Policy set
- No
- Cache-Control: no-store on authenticated responses
- Yes
- Server and X-Powered-By banners removed
- No
Results
- Header Score
- 57 / 100
- Header Grade
- D — Weak
- HSTS Assessment
- Below the 31536000-second bar required for preload
- Missing Headers
- Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, banner removal
- Headers Missing
- 4
- Residual Exposure
- 43%
Step by step
- 1Values used
- 2Security Header Score
- 3Header Score= 57 / 100
- 4Header Grade= D — Weak
- 5HSTS Assessment= Below the 31536000-second bar required for preload
- 6Missing Headers= Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, banner removal
- 7Headers Missing= 4
- 8Residual Exposure= 43
Assumptions and limits
- The result is derived only from the 12 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation or compounding frequency into account.
- Figures are rounded for display to whole numbers, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is Security Header Score calculated?
Header score = CSP (25 strict, 12 with unsafe-inline, 5 Report-Only) + HSTS (14 at max-age ≥ 31536000, 10 at ≥ 15552000, plus 4 includeSubDomains and 2 preload) + 10 framing + 8 nosniff + 8 Referrer-Policy + 7 Permissions-Policy + 7 COOP + 5 CORP + 5 Cache-Control + 5 banner removal = 100. CSP and HSTS take 45 of the 100 points because they are the only two headers that stop an attack class outright rather than trimming an edge. HSTS is scored on a curve: anything below one year fails the preload requirement, and includeSubDomains only counts once a policy is actually being sent.
Why does Security Header Score matter?
Headers are the cheapest security work available — a single response filter — and the score is what an external observer, including your customer's security questionnaire, will see.
What values do I need to enter?
This calculator takes 12 inputs: Content-Security-Policy, HSTS max-age, HSTS includeSubDomains, HSTS preload, Framing blocked by frame-ancestors or X-Frame-Options, X-Content-Type-Options: nosniff, Referrer-Policy set to a private value, Permissions-Policy restricts powerful features, Cross-Origin-Opener-Policy: same-origin, Cross-Origin-Resource-Policy set, Cache-Control: no-store on authenticated responses, Server and X-Powered-By banners removed. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Why does HSTS need a year?
Because the preload list requires max-age of at least 31536000 seconds together with includeSubDomains and preload, and because a short window leaves a user who has not visited recently exposed to the first-request downgrade that HSTS exists to prevent. Ramp up from a short value, then commit to a year.