~/tools $ ./headers --grade
Security Header Grader
Paste HTTP response headers and get a grade, with specific fixes for every missing or weak header.
Runs entirely in your browser. Nothing you paste is sent anywhere.
Grade
-
Getting the headers
Run curl -sI https://example.com against a site you are allowed to test, or copy them from the Network tab in your browser's developer tools. Check the page that matters, such as the login or account page, not only the homepage.
Reading the grade
Headers are defense in depth. A perfect grade does not mean a site is secure, and a missing header is usually a low severity finding on its own. They matter most as amplifiers: a missing CSP turns a minor HTML injection into full XSS. Report them in context, alongside the bug they would have stopped.