HTTP headers

What this tool does

MtrXTools requests the URL and follows up to 10 redirects, showing the status code, headers and timing of every hop. Then it grades the security headers on the final page, the one visitors actually land on.

How the security headers are scored

Each header adds points, out of 100: A+ needs 95, A 85, B 70, C 55 and D 40.

• Strict-Transport-Security (25): forces HTTPS on return visits. Full points need a max-age of at least 180 days; one year with includeSubDomains is the usual choice.
• Content-Security-Policy (25): the strongest defence against cross-site scripting. A policy that allows 'unsafe-inline' or 'unsafe-eval' without nonces gets partial points.
• Clickjacking protection (15): X-Frame-Options or the CSP frame-ancestors directive.
• X-Content-Type-Options: nosniff (10), Referrer-Policy (10), Permissions-Policy (10) and Cross-Origin-Opener-Policy (5).
• Minus 5 each for a Server header with a version number and for X-Powered-By, which tell attackers what to target.

A good starting set

For nginx, add these inside the server block (Apache uses Header always set). Test the CSP with Content-Security-Policy-Report-Only first, because a strict policy can block scripts the site needs.

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; add_header X-Content-Type-Options nosniff always; add_header Referrer-Policy strict-origin-when-cross-origin always; add_header X-Frame-Options DENY always;

Redirect codes and what they mean

• 301 and 308: permanent. Browsers and search engines remember them, and search ranking moves to the new URL. 308 also keeps the request method, which matters for forms and APIs.
• 302 and 307: temporary. Use them for short-term moves, logins and A/B tests, not for permanent HTTPS or www redirects.
• Every extra hop adds a round trip before the page starts loading. From any entry point (http, https, with or without www) aim for at most one redirect to the final URL.

Other headers worth reading

• Cache-Control and Age: how long browsers and CDNs may reuse the response. A CDN header such as CF-Cache-Status or X-Cache shows whether the request was a cache hit.
• Vary: which request headers change the response. Vary: * or a long list stops CDNs from caching well.
• Set-Cookie: session cookies should carry Secure, HttpOnly and a SameSite value.

Questions

Should I still set X-XSS-Protection?

No. Modern browsers removed the XSS filter it controlled, and the header isn't graded. A Content-Security-Policy replaces it.

Why does the grade use the last redirect?

Headers on a redirect response are mostly ignored by browsers (HSTS is the exception). What protects visitors is what the final page sends, so that is what is graded.

What does a redirect loop look like here?

The chain stops after 10 hops with an error, and the hops show the same URLs repeating. That is the "too many redirects" error browsers show; it is usually a CDN set to flexible SSL talking to an origin that redirects to HTTPS.