Security Headers

The security headers check evaluates your website's HTTP response headers against recommended security best practices. Missing or misconfigured security headers leave your site vulnerable to clickjacking, XSS, MIME sniffing, and other attacks.

How It Works

Hoppla sends an HTTP GET request to your monitor's URL and inspects the response headers. Each security header is analyzed individually, and an overall score (0-100) and letter grade (A+ through F) are calculated.

This is an advisory check -- it produces warnings for low grades but never creates incidents.

Headers Checked

Hoppla evaluates the following security headers:

Strict-Transport-Security (HSTS) -- 25 points

Forces browsers to use HTTPS for all future requests to your domain. Hoppla checks:

• Presence -- Is the header set?
• max-age -- Should be at least 31,536,000 (1 year). Lower values receive a warning.
• includeSubDomains -- Bonus 5 points if present.
• preload -- Bonus 5 points if present.

Content-Security-Policy (CSP) -- 25 points

Controls which resources the browser is allowed to load. Hoppla checks:

• Presence -- Is the header set?
• default-src or script-src -- At least one of these directives should be present for full credit. A CSP without either receives partial credit (50%).

X-Content-Type-Options -- 10 points

Prevents browsers from MIME-sniffing the response content type.

• Must be set to nosniff for full credit.

X-Frame-Options -- 10 points

Prevents your page from being embedded in iframes on other sites (clickjacking protection).

• Must be set to DENY or SAMEORIGIN for full credit.
• ALLOW-FROM is deprecated and receives zero points.

Referrer-Policy -- 10 points

Controls how much referrer information is sent with requests. Secure values:

• no-referrer
• strict-origin
• strict-origin-when-cross-origin
• same-origin

Other values (e.g., unsafe-url, no-referrer-when-downgrade) receive zero points.

Permissions-Policy -- 10 points

Controls which browser features (camera, microphone, geolocation, etc.) your site can access.

• Any valid Permissions-Policy header receives full credit.

X-XSS-Protection (informational)

This header is deprecated in modern browsers and is not scored. Hoppla reports its presence for informational purposes only.

Scoring and Grades

The total score is calculated by summing points for each header:

Grade	Score Range
A+	100
A	90-99
B	70-89
C	50-69
D	30-49
F	0-29

Status Mapping

Grade	Check Status
A+ or A	ok
B, C, D, or F	warning

Results

Each security headers check result includes:

• Status -- ok or warning
• Grade -- Letter grade from A+ to F
• Score -- Numeric score from 0 to 100
• Header analysis -- For each header: name, whether it is present, its value, pass/warning/fail status, and a human-readable explanation
• Raw headers -- The full set of response headers (with sensitive headers like Set-Cookie and Authorization stripped)

Configuration

Setting	Default	Description
Check interval	Per schedule	How often to check security headers.

The grading thresholds are fixed and match industry-standard security header grading (similar to securityheaders.com).

Alerts

Warning Notification

A warning.security_headers notification is sent when the security headers grade is B or lower. The notification includes the grade and score.

Notification Events

Event	When
warning.security_headers	Security headers grade dropped below A
warning.cleared	Security headers grade improved to A or A+

Improving Your Score

Here is a starter set of security headers you can add to your web server configuration:

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Security-Policy: default-src 'self'; script-src 'self'
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()

WARNING

The Content-Security-Policy header in the example above is intentionally strict. You will likely need to customize it for your application. Start with Content-Security-Policy-Report-Only to test your policy before enforcing it.