4.10Security headers score
Type: security.score. Checks: a score from 0 to 100 for the security headers in the response. Security headers tell browsers how to protect your visitors. Each header in the table below earns points.
Grades: A is 90 or more. B is 75 or more. C is 60 or more. D is 40 or more. F is below 40.
Operators: usually gt. Also lt, eq, neq.
| Type | Operator | Value | What it means |
|---|---|---|---|
security.score | gt | 89 | Keep grade A. |
security.score | gt | 74 | Grade B or better. |
security.score | eq | 100 | Every header is in place. |
When it fails: the message gives the score, the grade and what is missing. For example: assertion security.score > 89: got 65 (grade C); missing: Content-Security-Policy, Permissions-Policy.
How to raise your score#
Add each header named after missing: in the message. This table shows what earns points.
| Send this header | Points | Name in the missing list |
|---|---|---|
Strict-Transport-Security with max-age of at least 15552000 (180 days). It tells browsers to always use https. A shorter max-age earns 10. It counts on https only. | 25 | Strict-Transport-SecurityHSTS max-age under 180 daysHSTS (not https) |
Content-Security-Policy, with any value. It limits what a page may load. | 25 | Content-Security-Policy |
X-Content-Type-Options: nosniff | 15 | X-Content-Type-Options |
X-Frame-Options: DENY or SAMEORIGIN, or frame-ancestors in your Content-Security-Policy. It stops other sites from showing your page in a frame. | 15 | X-Frame-Options or frame-ancestors |
Referrer-Policy, with any value except unsafe-url, such as strict-origin-when-cross-origin. | 10 | Referrer-Policy |
Permissions-Policy, with any value. It controls browser features, such as the camera. | 10 | Permissions-Policy |