The HTTP Security Headers & CSP Configuration Auditor evaluates server response header hardening configurations and calculates an objective security posture grade to defend against XSS, clickjacking, and MIME attacks.

### Scoring Methodology & Penalty Deduction Formulas The auditor benchmarks header policies against modern OWASP defense standards, starting at a base score of 100 points: - Strict-Transport-Security (HSTS): - Preloaded with Subdomains (`max-age=63072000`): 0 penalty - Basic Enabled (`max-age=31536000`): -10 penalty - Missing or Disabled: -30 penalty (leaves connections open to SSL stripping) - Content-Security-Policy (CSP): - Strict Policy (`default-src 'self'`, no unsafe eval): 0 penalty - Relaxed Policy (permits `unsafe-inline` scripts): -15 penalty - Missing Policy: -35 penalty (leaves DOM vulnerable to cross-site scripting) - X-Frame-Options (Clickjacking Defense): - `DENY` or `SAMEORIGIN`: 0 penalty - Missing Header: -20 penalty (allows malicious iframe framing) - X-Content-Type-Options: - `nosniff`: 0 penalty - Missing Header: -15 penalty (allows browser MIME-type sniffing) - Final Security Grade: $$\text{Final Score} = \max(0, 100 - [\text{HSTS} + \text{CSP} + \text{Frame} + \text{MIME Penalties}])$$ Graded as A+ ($95\text{--}100$), A ($85\text{--}94$), B ($70\text{--}84$), C ($50\text{--}69$), or F ($<50$).

### Worked Numeric Example Consider an audit for a partially configured web application: - Strict-Transport-Security: Basic Enabled (-10 pts) - Content-Security-Policy: Relaxed Policy (-15 pts) - X-Frame-Options: SAMEORIGIN (0 pts) - X-Content-Type-Options: nosniff (0 pts) - Audit Calculation: - Total Deductions: $10 + 15 = 25\text{ points}$ - Final Audit Score: $100 - 25 = 75\text{ points}$ - Resulting Security Grade: Grade B (Adequate defense, CSP tightening recommended)

### In-Browser Security Assessment All security policy evaluations and scoring deductions calculate locally inside client-side JavaScript with zero server telemetry.