Security Header Score Calculator
Grade your HTTP security headers with weighted scoring, including whether HSTS max-age clears the one-year preload bar.
Inputs
Weight 4
Weight 2
Weight 10
Weight 8
Weight 8
Weight 7
Weight 7
Weight 5
Weight 5
Header Score
57/ 100
Header Grade
D — Weak
HSTS Assessment
Below the 31536000-second bar required for preload
Missing Headers
Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, banner removal
Headers Missing
4
Residual Exposure
43%
Step by step
Values used
Content-Security-Policy = Allow-list with unsafe-inline — 12; HSTS max-age = 15,552,000 seconds; HSTS includeSubDomains = Yes; HSTS preload = No; Framing blocked by frame-ancestors or X-Frame-Options = Yes; X-Content-Type-Options: nosniff = Yes; Referrer-Policy set to a private value = Yes; Permissions-Policy restricts powerful features = No; Cross-Origin-Opener-Policy: same-origin = No; Cross-Origin-Resource-Policy set = No; Cache-Control: no-store on authenticated responses = Yes; Server and X-Powered-By banners removed = No
Security Header Score
Header score = CSP (25 strict, 12 with unsafe-inline, 5 Report-Only) + HSTS (14 at max-age ≥ 31536000, 10 at ≥ 15552000, plus 4 includeSubDomains and 2 preload) + 10 framing + 8 nosniff + 8 Referrer-Policy + 7 Permissions-Policy + 7 COOP + 5 CORP + 5 Cache-Control + 5 banner removal = 100.
Header Score
= 57 / 100
Header Grade
= D — Weak
HSTS Assessment
= Below the 31536000-second bar required for preload
Missing Headers
= Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, banner removal
Headers Missing
= 4
Residual Exposure
= 43
How it works
CSP and HSTS take 45 of the 100 points because they are the only two headers that stop an attack class outright rather than trimming an edge. HSTS is scored on a curve: anything below one year fails the preload requirement, and includeSubDomains only counts once a policy is actually being sent. Headers are the cheapest security work available — a single response filter — and the score is what an external observer, including your customer's security questionnaire, will see.
Formula
Security Header Score
Header score = CSP (25 strict, 12 with unsafe-inline, 5 Report-Only) + HSTS (14 at max-age ≥ 31536000, 10 at ≥ 15552000, plus 4 includeSubDomains and 2 preload) + 10 framing + 8 nosniff + 8 Referrer-Policy + 7 Permissions-Policy + 7 COOP + 5 CORP + 5 Cache-Control + 5 banner removal = 100.
- max-age ≥ 31536000
- One year, the minimum for the preload list
- COOP
- Cross-Origin-Opener-Policy, which isolates the browsing context
Frequently Asked Questions
How is Security Header Score calculated?
Header score = CSP (25 strict, 12 with unsafe-inline, 5 Report-Only) + HSTS (14 at max-age ≥ 31536000, 10 at ≥ 15552000, plus 4 includeSubDomains and 2 preload) + 10 framing + 8 nosniff + 8 Referrer-Policy + 7 Permissions-Policy + 7 COOP + 5 CORP + 5 Cache-Control + 5 banner removal = 100. CSP and HSTS take 45 of the 100 points because they are the only two headers that stop an attack class outright rather than trimming an edge. HSTS is scored on a curve: anything below one year fails the preload requirement, and includeSubDomains only counts once a policy is actually being sent.
Why does Security Header Score matter?
Headers are the cheapest security work available — a single response filter — and the score is what an external observer, including your customer's security questionnaire, will see.
What values do I need to enter?
This calculator takes 12 inputs: Content-Security-Policy, HSTS max-age, HSTS includeSubDomains, HSTS preload, Framing blocked by frame-ancestors or X-Frame-Options, X-Content-Type-Options: nosniff, Referrer-Policy set to a private value, Permissions-Policy restricts powerful features, Cross-Origin-Opener-Policy: same-origin, Cross-Origin-Resource-Policy set, Cache-Control: no-store on authenticated responses, Server and X-Powered-By banners removed. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Why does HSTS need a year?
Because the preload list requires max-age of at least 31536000 seconds together with includeSubDomains and preload, and because a short window leaves a user who has not visited recently exposed to the first-request downgrade that HSTS exists to prevent. Ramp up from a short value, then commit to a year.