Grade your HTTP security headers with weighted scoring, including whether HSTS max-age clears the one-year preload bar.
CSP and HSTS take 45 of the 100 points because they are the only two headers that stop an attack class outright rather than trimming an edge. HSTS is scored on a curve: anything below one year fails the preload requirement, and includeSubDomains only counts once a policy is actually being sent. Headers are the cheapest security work available — a single response filter — and the score is what an external observer, including your customer's security questionnaire, will see.
Security Header Score
Header score = CSP (25 strict, 12 with unsafe-inline, 5 Report-Only) + HSTS (14 at max-age ≥ 31536000, 10 at ≥ 15552000, plus 4 includeSubDomains and 2 preload) + 10 framing + 8 nosniff + 8 Referrer-Policy + 7 Permissions-Policy + 7 COOP + 5 CORP + 5 Cache-Control + 5 banner removal = 100.
Header score = CSP (25 strict, 12 with unsafe-inline, 5 Report-Only) + HSTS (14 at max-age ≥ 31536000, 10 at ≥ 15552000, plus 4 includeSubDomains and 2 preload) + 10 framing + 8 nosniff + 8 Referrer-Policy + 7 Permissions-Policy + 7 COOP + 5 CORP + 5 Cache-Control + 5 banner removal = 100. CSP and HSTS take 45 of the 100 points because they are the only two headers that stop an attack class outright rather than trimming an edge. HSTS is scored on a curve: anything below one year fails the preload requirement, and includeSubDomains only counts once a policy is actually being sent.
Headers are the cheapest security work available — a single response filter — and the score is what an external observer, including your customer's security questionnaire, will see.
This calculator takes 12 inputs: Content-Security-Policy, HSTS max-age, HSTS includeSubDomains, HSTS preload, Framing blocked by frame-ancestors or X-Frame-Options, X-Content-Type-Options: nosniff, Referrer-Policy set to a private value, Permissions-Policy restricts powerful features, Cross-Origin-Opener-Policy: same-origin, Cross-Origin-Resource-Policy set, Cache-Control: no-store on authenticated responses, Server and X-Powered-By banners removed. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Because the preload list requires max-age of at least 31536000 seconds together with includeSubDomains and preload, and because a short window leaves a user who has not visited recently exposed to the first-request downgrade that HSTS exists to prevent. Ramp up from a short value, then commit to a year.