HTTP Security Headers Check

One request for the home page of a public site, made from an AOD Pulse probe. Redirects are not followed and the result is kept for 24 hours. Cookie values are never kept.

How the grade works

Points per header: Strict-Transport-Security 20, Content-Security-Policy 25, X-Content-Type-Options 10, framing protection 15, Referrer-Policy 10, Permissions-Policy 5, cookie flags 15. A is 90 or more, B 80, C 65, D 50, otherwise F. An invalid certificate caps the grade at D. Only https:// addresses are graded.