HTTP Security Headers & CSP Analyzer

What a good set of headers looks like

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests
x-content-type-options: nosniff
x-frame-options: DENY
referrer-policy: strict-origin-when-cross-origin
permissions-policy: camera=(), microphone=(), geolocation=(), payment=()
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin

That is what this site sends. For an application with inline scripts the CSP changes to nonces: script-src 'nonce-<random per response>' 'strict-dynamic', which is both stricter and easier to maintain than a host allowlist.

How the CSP evaluation thinks

A CSP exists to limit what an attacker can do once they have found an injection point. So the evaluation asks: given one injected string, can scripts run? 'unsafe-inline' without nonces says yes. A wildcard or scheme source (*, https:, data:) says yes. A host that serves attacker-selectable scripts (public CDNs with old AngularJS, JSONP endpoints on googleapis.com, storage buckets) says yes, which is why a long allowlist of popular CDNs is weaker than it looks. Missing object-src and base-uri are the two directives people forget that re-open the door. The remaining directives (frame-ancestors, form-action, default-src) matter for clickjacking and data exfiltration rather than script execution, so they are rated lower.

Where to set headers

nginx: add_header Name "value" always; — remember that an add_header inside a location cancels all the server-level ones (test with the nginx location tester).
Apache: Header always set Name "value" in the vhost or .htaccess (mod_headers).
Cloudflare: HSTS under SSL/TLS → Edge Certificates; other headers via Transform Rules → Modify Response Header, which also works for origins you cannot change.
Application frameworks: helmet (Node), secure_headers (Rails), django-csp, Laravel middleware — these also generate per-response nonces.

Rolling out a CSP safely

Send it as Content-Security-Policy-Report-Only with a report-to endpoint and watch reports for a week.
Fix the real violations (inline handlers, third-party widgets), ignore the browser-extension noise.
Switch the header name to Content-Security-Policy. Keep report-only around for testing the next change.

Questions

Which headers matter most?

For a site with any user interaction: Content-Security-Policy first, then Strict-Transport-Security and X-Content-Type-Options. Framing and referrer policies are cheap to add. The rest is hygiene: hide versions, flag cookies, drop deprecated headers.

Why is my CSP rated weak although it lists only trusted hosts?

Because trust is not the question; the question is whether any script on those hosts can be made to run attacker code. Public CDNs host thousands of library versions, some with known gadgets (AngularJS templates, JSONP callbacks). A nonce-based policy with strict-dynamic does not have that problem, and this page rates it as the strongest setup.

Is X-XSS-Protection still useful?

No. Chrome removed the XSS auditor in 2019, Edge in 2018; Firefox never had it. The header is harmless as “0” and was harmful as “1; mode=block” in old browsers. Remove it and use CSP.

How do I get the headers of a page that redirects?

curl -sIL https://example.com/ prints each response in the chain. Paste it all; the last response is graded and the redirects are listed. Check that http:// redirects to https:// in one hop.

Does the grade match securityheaders.com?

Roughly: both count the same six core headers. This page additionally evaluates the CSP content rather than just its presence, and deducts for leaks and deprecated headers, so a site with a weak CSP scores lower here.