How to read results
HeaderGrade fetches public HTTP(S) response headers (HEAD preferred, GET fallback) and applies a simple deterministic rubric. It does not crawl your site, execute JavaScript, or prove absence of vulnerabilities.
Letter grades
- A — Most checked headers present with reasonable values (score ≥ 90).
- B — Solid coverage with a few gaps (75–89).
- C — Mixed (60–74).
- D — Many gaps (40–59).
- F — Few or none of the checked headers (below 40).
Per-header status
- pass — Expected shape present.
- warn — Present but soft, short-lived, or incomplete; or optional gap.
- fail — Missing where the rubric expects a signal.
- unknown — Optional Cross-Origin-* headers absent.
Fix snippets
Nginx / Caddy / Cloudflare / Vercel examples are starting points only. Wrong CSP values can break production frontends.
Sharing
Reports use opaque high-entropy IDs at /r/:id. There is no public list of reports.