Security Headers

Headers the server adds to responses to protect visitors: HSTS forces HTTPS, CSP restricts scripts, X-Frame-Options prevents clickjacking, nosniff and Referrer-Policy reduce other data leaks.

Start at 100 and subtract points for each missing or weak header; HSTS, CSP and the HTTP→HTTPS redirect weigh the most. A ≥ 90, B ≥ 75, C ≥ 60, D ≥ 40, otherwise F.

Yes if too strict: start with a policy allowing the resources you really use (CDN, fonts, inline if needed) and check the browser console before tightening it.