HTTP Security Headers Explained: How Websites Earn an A Grade
HSTS, Content-Security-Policy, X-Frame-Options and more — what each security header protects against, how they add up to a security grade, and how to inspect them on any site.
Why response headers are a security signal
Before a page renders a single pixel, the server has already told your browser how much to trust it. HTTP response headers are instructions: whether the connection must stay encrypted, which scripts are allowed to run, and whether the page may be framed by other sites. Two pages can look identical on screen while one is hardened and the other is wide open — the difference is a handful of header lines.
That is why Redirect Radar folds headers into a single security grade from A to F for every hop it traces: the grade compresses several technical checks into one glanceable signal.
The headers that move the grade
Strict-Transport-Security (HSTS)
Tells the browser: never talk to this domain over plain HTTP again. Once seen, the browser upgrades every future request to HTTPS before it leaves the machine, which kills SSL-stripping attacks on public Wi-Fi. The max-age value is how long the promise lasts — a year or more is the norm.
strict-transport-security: max-age=31536000; includeSubDomains; preload
Content-Security-Policy (CSP)
The strongest and most complex header. A CSP lists where scripts, styles, images, and frames may load from, so an injected script tag from an untrusted origin simply refuses to run. It is the main defense against cross-site scripting (XSS) and data exfiltration via injected markup.
content-security-policy: default-src 'self'; script-src 'self'
X-Frame-Options / frame-ancestors
Controls whether the page may be embedded in an iframe. Without it, an attacker can overlay your login form inside their own page and steal clicks — the classic clickjacking attack. Modern sites express the same rule through CSP's frame-ancestors directive; the legacy header still guards older browsers.
x-frame-options: DENY
X-Content-Type-Options
One word: nosniff. It forbids browsers from guessing a file's type, so an uploaded image that secretly contains JavaScript cannot be executed as a script. Cheap to set, no downside.
x-content-type-options: nosniff
Referrer-Policy
Decides how much of the current URL is leaked to third parties when you follow a link or load a resource. Without it, full URLs — including tokens in query strings — can end up in someone else's analytics. strict-origin-when-cross-origin is the common balanced choice.
referrer-policy: strict-origin-when-cross-origin
Permissions-Policy
A kill switch for powerful browser features — camera, microphone, geolocation, payment. Declaring camera=(), microphone=(), geolocation=() means neither your page nor any embedded third party can request those sensors.
permissions-policy: camera=(), microphone=(), geolocation=()
How the headers add up to a grade
No single header makes a site safe — the grade reflects the whole picture. HTTPS is the foundation: without it, headers travel over a channel anyone on the network can rewrite, so plain-HTTP hops score poorly no matter what else is set. On top of that, each present header closes a specific hole.
Inspect the headers on any link
You do not need a separate scanner to read these. Open Redirect Radar on any page — or trace a short link — and every hop shows its full response headers next to its status code, with the resulting grade right beside it. Missing strict-transport-security? An unexpected x-frame-options value? You see it in the same panel where the redirect chain lives.
This is especially revealing mid-chain: tracking domains and ad redirects often have far weaker header sets than the final destination, and the grade makes that gap visible at a glance.
Sharing links of your own? T.LY keeps them clean and HTTPS-first. Create a short link with T.LY, then trace it in Redirect Radar to check the grade your audience actually gets. Get started with T.LY → and take 20% off your first month or a yearly plan with code
Conclusion
Security headers are small lines of text with outsized impact: HSTS locks in encryption, CSP defangs injected scripts, frame headers stop clickjacking, and the sniffing, referrer, and permission policies close quieter leaks. Sites that set them earn their A; sites that skip them are betting their users will not notice. Now you can check — hop by hop, header by header.