HTTP Security Headers Score & Configuration Generator

Audit HSTS, CSP, Permissions-Policy, X-Content-Type-Options, and generate server hardening configurations.

A+

Security Grade: A+ (100/100)

All 6 critical defense-in-depth security headers are enabled!

Security Headers Switchboard

Strict-Transport-Security+25 points

Enforces HTTPS and protects against SSL stripping attacks.

X-Content-Type-Options+20 points

Prevents MIME-sniffing attacks on stylesheets and scripts.

X-Frame-Options+15 points

Blocks clickjacking by preventing external pages from embedding in iframes.

Referrer-Policy+15 points

Protects user privacy by stripping paths from referrers across domains.

Permissions-Policy+15 points

Disables invasive browser features (camera, mic, GPS) by default.

Cross-Origin-Opener-Policy+10 points

Isolates browsing context to protect against Spectre-like memory leaks.

Generated Server Hardening Snippet

# Nginx Security Headers configuration
server {
    listen 443 ssl http2;
    server_name example.com;

    # Defense-in-Depth Security Headers
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "DENY" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
    add_header Cross-Origin-Opener-Policy "same-origin" always;

    location / {
        proxy_pass http://127.0.0.1:3000;
    }
}

Defense-in-Depth HTTP Security Headers

Modern web browsers provide robust, built-in security features that can be activated by serving specific HTTP Response Headers. Implementing these headers shields web applications against downgrade attacks, clickjacking, MIME confusion, and cross-site leaks without requiring changes to application business logic.

The Essential Security Header Baseline

Strict-Transport-Security (HSTS): Forces the browser to communicate exclusively over encrypted HTTPS connections for the specified max-age duration (e.g. 1 year / 31,536,000 seconds), defeating Man-in-the-Middle SSL stripping.
X-Content-Type-Options: nosniff: Stops browsers from guessing the MIME type of a response, forcing strict adherence to the server's Content-Type and mitigating malicious script execution hidden within image files.
Referrer-Policy: strict-origin-when-cross-origin: Strips full URL query parameters and sensitive pathnames from the Referer header when transitioning between cross-origin endpoints.