Security Header Grader
Paste response headers from a website you own or are authorised to review. The analysis runs entirely in this browser: HAPSA does not receive, store or look up the pasted content.
Paste response headers
Use the response-header section from browser developer tools or a command such as curl -I https://example.com. Remove cookies, tokens or internal identifiers before pasting.
Review summary
Methodology
Version 1.0 checks presence and selected safe configuration signals for Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, frame protections, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy. Scores are directional and intentionally conservative.
| Score | Meaning |
|---|---|
| A (85–100) | Strong baseline signals are present; application testing is still required. |
| B (70–84) | Useful baseline with notable improvement opportunities. |
| C (50–69) | Several important browser controls are absent or weak. |
| D (30–49) | Material defensive-header gaps. |
| F (0–29) | Little evidence of a defensive-header baseline in the pasted sample. |
Need context beyond a score?
We can review the application, deployment constraints and policy compatibility before recommending changes.