Question 1

Which HTTP security headers are checked?

Accepted Answer

Content-Security-Policy, Strict-Transport-Security, X-Frame-Options (or the CSP frame-ancestors directive), X-Content-Type-Options, Referrer-Policy, Permissions-Policy and Cross-Origin-Opener-Policy, plus the redirect from http:// to https://. Each check shows the received value, its diagnosis, why it matters and the recommended value. Server, X-Powered-By, Set-Cookie, CORS and deprecated headers (X-XSS-Protection, Expect-CT, HPKP) are reported separately, without affecting the score.

Question 2

How is the score calculated?

Accepted Answer

Eight checks for 100 points: CSP 25, HSTS 20, clickjacking protection 15, X-Content-Type-Options 10, Referrer-Policy 10, HTTPS redirect 10, Permissions-Policy 5 and COOP 5. A compliant check earns all its points, one that needs work earns half (CSP with unsafe-inline, HSTS under 180 days…), a missing or unsafe header earns zero. Grades range from A+ (95 and above) to F (under 40).

Question 3

Is the SSL/TLS certificate analyzed?

Accepted Answer

Yes. The request goes through a real TLS connection, so an expired certificate, one issued for another name or signed by an unknown authority is detected. Details (issuer, dates, days left, key, covered names, SHA-256 fingerprint) come from public Certificate Transparency logs via Cert Spotter. For protocols and cipher suites, the tool links to SSL Labs.

Question 4

How do I fix missing headers?

Accepted Answer

The Fixes tab generates a snippet for Nginx, Apache, IIS (web.config), Caddy or the _headers file of Netlify and Cloudflare Pages, limited to missing or weak headers. The suggested CSP is a starting point: adapt it to your domains and test it with Content-Security-Policy-Report-Only first.

Question 5

Can I analyze an internal site?

Accepted Answer

No. The request goes through our proxy to work around browser CORS restrictions: only sites publicly reachable on the Internet can be analyzed. Local, private and reserved addresses are refused.

Certificate & HTTP Analyzer

What the analysis checks

Scoring out of 100