Security Headers Grader

Fetch any URL from Cloudflare's edge and score its security headers with pass/warn/fail guidance.

Features

• Grades HSTS, CSP, clickjacking protection, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and Cross-Origin-Opener-Policy
• Returns a numeric score (0–100) and letter grade (A–F)
• Uses HEAD with GET fallback when origins reject HEAD
• Stateless; no bindings required

API Reference

GET /grade

Example Request

curl "https://your-worker.workers.dev/grade?url=https://www.cloudflare.com"

Success Response

url string

Final URL after redirects

score number

Average score from 0–100 across all checks

grade string

Letter grade: A, B, C, D, or F

checks array

Per-header results with header, status (pass | warn | fail | missing), detail, and recommendation

headers object

Raw response headers as lowercase key/value pairs

{
  "url": "https://www.cloudflare.com/",
  "score": 71,
  "grade": "C",
  "checks": [
    {
      "header": "Strict-Transport-Security",
      "status": "pass",
      "detail": "max-age=31536000; includeSubDomains; preload",
      "recommendation": "Looks good"
    }
  ],
  "headers": {
    "strict-transport-security": "max-age=31536000; includeSubDomains; preload"
  }
}

Error Codes

• 400 - Missing or invalid url (INVALID_URL)
• 502 - Fetch failed (FETCH_ERROR)

Use Cases

• Audit security headers before launching a site
• Compare header posture across environments
• Teach Workers fetch + header analysis patterns
• Generate actionable remediation tips for missing headers

Limitations

• Scoring is heuristic, not a formal compliance audit
• Does not execute or fully validate CSP policy correctness
• Only inspects response headers visible to the edge fetch

Deployment

curl "https://your-worker.workers.dev/grade?url=https://example.com"

Local Development

cd apps/experiments/security-headers-grader
npm install
npm run dev

curl "http://localhost:8787/grade?url=https://www.cloudflare.com"

Cloudflare Features Used

• Workers - Edge compute runtime
• Fetch API - HEAD/GET requests from the edge
• Edge network - Low-latency header inspection

Next Steps