What is a good security header grade?

Best move: treat A as the target, B as fine, and anything C or below as a lead worth a closer look.

Why it works: the grade is a checklist over six response headers plus TLS. Each header is present or it is not, so the score maps to configuration discipline you can read at a glance.

Key takeaways

• An A grade means the six response headers are present and configured on a modern TLS setup. It is a hygiene score, not a vulnerability scan.
• The six headers checked: HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy.
• CSP and HSTS carry the most weight. A site missing both cannot reach an A no matter how many softer headers it sets.
• A high grade tracks an engineering team that ships with care. It does not prove the code is free of bugs, so read it as a discipline signal.
• Bassethound fuses the header grade and TLS grade into one security_grade, alongside the other four layers, in a single call.

Which headers does the grade check?

The grade scores six response headers. HSTS (Strict-Transport-Security) forces browsers onto HTTPS and blocks downgrade attacks. CSP (Content-Security-Policy) constrains which scripts, styles, and origins a page can load, the strongest single defense against cross-site scripting. X-Content-Type-Options stops MIME sniffing. X-Frame-Options (and CSP frame-ancestors) blocks clickjacking. Referrer-Policy controls what URL data leaks to third parties. Permissions-Policy gates access to camera, geolocation, and other browser features.

Not every header carries equal weight. CSP and HSTS are load-bearing. A site missing both lands well below an A regardless of how many softer headers it sets. X-Content-Type-Options is a one-line win most teams get right. Well-run sites skip Permissions-Policy and Referrer-Policy more than any other header, and that absence is what separates an A from a B.

Bassethound reports each header as present or absent with the value it found, so the letter grade is never a black box. You see the exact controls in place and the ones that pull the score down.

What separates an A from a B?

An A means the full set is present and sane. B means one or two softer headers are absent while CSP and HSTS hold. On real, well-run sites, B is the common result. Teams ship strict transport security and a content policy, then leave Permissions-Policy unset because it does not map to an obvious threat for their app.

Read the A-to-B gap as small. Both grades signal a team that thinks about response headers. The meaningful cliff sits lower down. A C means CSP is weak or absent. A D or F means the site is missing multiple load-bearing controls, which points to a team that never treated headers as part of shipping.

So do not chase A as a pass-fail line. Chase the shape of the whole grade. An A with a weak TLS config is worse than a B with modern TLS. The letter is a summary. The evidence under it is what you act on.

Does a high grade mean the site is secure?

No, and treating it that way is the common mistake. A header grade measures response-header hygiene. It says nothing about the application behind those headers. A site can hold an A and still ship SQL injection, broken auth, or a leaking API. The grade proves the team configured the browser-facing controls. Whether the code behind them is sound is a separate question.

What a high grade does tell you is discipline. Setting CSP correctly is fiddly work that breaks pages when done wrong. A team that shipped a working content policy has engineers who care about the security surface and test their changes. That correlation is the signal you want, and it stops short of a guarantee.

Read the grade as one input. Pair it with the TLS grade, the email-auth booleans (SPF, DKIM, DMARC), and the rest of the infrastructure layer before you draw a conclusion. A single letter starts a closer look. It never ends one. Bassethound reports the grade with its evidence so you can see what it does and does not cover.

How does the TLS grade fit in?

The header grade covers what the server tells the browser. The TLS grade covers how the connection itself is secured. Bassethound reads the certificate (issuer, SANs, expiry, days_remaining) and the transport configuration, then grades it against modern baselines like the Mozilla SSL configuration guidance.

A strong TLS grade means current protocol versions, sane cipher choices, and a certificate that is valid and not close to expiry. A weak one flags old protocols, a cert near its expiry date, or a mismatch between the certificate SANs and the domain.

The two grades answer different questions, and both matter. You can hold an A on headers and still run a certificate that expires in nine days, an outage waiting to happen. Bassethound fuses both into one security_grade at the top of the dossier, then keeps the header grade and TLS grade separate underneath so you can see which side is weak. A summary that hides the split forces you to re-check by hand, which defeats the point of a spot-check.

What can you infer from a low grade?

A low grade is a lead, not a takedown. For outbound and qualification, read a C or below as a team that has not invested in front-end security hygiene. That can mean an early-stage product moving fast, a legacy site nobody owns, or a team without security review in the loop. Each is a different conversation.

Pair the grade with the other four layers to place it. A low header grade next to a shipping AI stack and modern infrastructure reads as a fast team with a gap, not a careless one. The same low grade next to stale tech and an expiring cert reads as a site in decline.

That correlation is why the grade lives inside a five-layer dossier instead of a standalone report. A header scanner hands you a letter. Bassethound hands you the letter and the context that tells you what it means for this specific domain. For a security spot-check inside a larger qualification pass, the context is the point.

Bassethound perspective

Header grading is a solved, commodity check. SecurityHeaders.com and Mozilla Observatory have graded response headers for years, and they do it well. If a letter grade in isolation were the product, we would have nothing to add.

Our conviction, and one a dedicated scanner would dispute: a security grade is close to useless on its own. A scanner gives you an A or an F with no idea whose domain it is, what they ship, or whether the gap matters. The grade only earns its keep next to the other four layers. An F on a dormant brochure site is noise. The same F on a company running a live AI stack against customer data is a finding. The letter did not change. The context did.

So we do not sell a header report. We fuse the header grade and TLS grade into the dossier next to tech stack, infrastructure, firmographics, and AI-readiness, in one keyless call. And we are honest about the edge: a grade covers the headers we can observe. A control enforced deeper in the stack, behind a proxy we cannot see, is a gap we report rather than guess at.

Sources

• MDN, Strict-Transport-Security (HSTS): https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
• MDN, Content-Security-Policy (CSP): https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
• Mozilla SSL Configuration Generator: https://ssl-config.mozilla.org
• RFC 6797, HTTP Strict Transport Security: https://datatracker.ietf.org/doc/html/rfc6797