Hoppla fetches your page on every run and grades the security headers the server actually sent back: HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy. It scores them out of 100, hands back a letter grade, and warns you when that grade drops below an A, on the next check. A one-off scanner tells you where you stood the day you ran it. Hoppla tells you after someone strips a header and ships it anyway.
GET acme.io · HSTS 35/35 · CSP 12/25 partial · XFO ✓ · XCTO ✓ · score 87 → B · WARNING
Fictional values. Not a live measurement.
Hoppla fetches your page and scores six response headers to a total of 100, then turns that into a letter grade. HSTS earns 25, plus 5 each for includeSubDomains and preload; a max-age under a year is flagged in the breakdown. A Content-Security-Policy with a default-src or script-src directive is worth 25; one without either, 12. X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy are 10 apiece. A+ and A pass quietly. B through F raise a warning. And because the grade gets recomputed on every check, a header someone quietly drops in a future deploy shows up on the next check, and trips that warning once the grade falls below an A, instead of sitting unnoticed until your next manual audit, whenever that happens to be.
On each run Hoppla requests your URL and inspects the security headers the server actually returned. Not a config file's intentions. Not last month's scan. The headers your visitors' browsers are getting right now.
HSTS earns 25, plus 5 for includeSubDomains and 5 for preload; a max-age under a year is flagged, not deducted. A Content-Security-Policy with a default-src or script-src directive scores 25, one without either 12. X-Content-Type-Options (nosniff), X-Frame-Options (DENY or SAMEORIGIN), Referrer-Policy (a strict value such as strict-origin-when-cross-origin) and Permissions-Policy are worth 10 each. The points sum to a score out of 100.
A+ and A pass and stay silent. Anything from B down to F raises a warning, because a B usually means a directive went missing in the last release, not that the headers were designed that way.
Before any result is saved, Set-Cookie, Cookie, Authorization and the authenticate headers are stripped out, so the session tokens and credentials they carry aren't stored. What's kept is the security-header picture and the points behind the grade.
A one-off grade is true the day you ran it and stale by the next release. A deploy flips CSP off or drops a header, and that A stays frozen in a screenshot nobody re-checks. Hoppla re-grades on every run, so a drop below an A surfaces as a warning on the next check.
Six headers, scored to a hundred, turned into a letter. You can see HSTS is full but CSP is only half-credited at 12, fix that one directive, and watch the grade climb on the next run. Not a vague checklist, a score with the points attached to each header.
A weak header grade is a posture problem, not an outage. Hoppla flags B-through-F as a warning, so it nudges you to harden the response without claiming your site is down or paging on-call over a missing Referrer-Policy.
You ran your site through a scanner once, hit an A, felt good, closed the tab. Three deploys later a framework upgrade quietly drops your Content-Security-Policy, and you'd never know. Hoppla holds you to that A on every run. The morning a deploy knocks the grade to a B, the warning arrives and the breakdown shows which header is now costing points, and you fix it before it becomes a line item on a security questionnaire from your first enterprise lead.
A client asks what you do for security, and you want a real answer, not a shrug. Put a header grade on each site and you have something concrete to show: HSTS, CSP, frame protection, graded and re-checked on every run. When a client's own developer pushes a change that weakens a header, you see the grade drop and can raise it back quickly. That's the difference between being their agency and being their last agency.
Across hundreds of client sites, header hygiene is invisible until a pen-test report turns it into a problem. Add the check to each client site and Hoppla grades its headers on every run, so an account manager can see which clients sit below an A, and a regression on any one of them shows up as a warning instead of a finding in someone else's audit. You hold the whole portfolio's posture without anyone re-scanning a single domain by hand.
Continuous header grading is a security line item you can sell, not just run. Offer it under your own brand and domain as an add-on: every customer site gets a letter grade refreshed on each check, and a regression warning arrives carrying your brand name and alert prefix. The customer who weakens a header on your platform hears it from you, framed as the security service they pay you for.
Import the monitors you already run in another tool. What comes across depends on the provider. Run both side by side for 24 hours or 7 days before you switch.
The importer opens in your workspace once you have access.
Get early accessA one-off scan grades the moment you ran it. Useful once, stale by the next deploy. Hoppla runs the same kind of grading continuously, so when a future release strips a header and the grade falls below an A, that becomes a warning, instead of something you'd only catch if you happened to re-scan. The value isn't the first grade. It's noticing the day it changes.
No. Security Headers is advisory. A B-through-F grade raises a warning, not a downtime incident, so it never triggers the outage alerting that wakes you up. It tells you your headers regressed. It never claims your site is offline.
No. Set-Cookie, Authorization and cookie headers are stripped before any result is saved. Hoppla grades and stores the security-header picture, but the session tokens and credentials those headers carry are not stored.
An A needs 90 points: HSTS, a Content-Security-Policy with a default-src or script-src directive, X-Content-Type-Options set to nosniff, X-Frame-Options as DENY or SAMEORIGIN, a strict Referrer-Policy and a Permissions-Policy. includeSubDomains and preload on HSTS add the last 10 for an A+. The score breakdown shows which header is costing you points, so you fix the gap instead of guessing. One honest caveat: Hoppla grades the headers you sent, not whether your CSP is actually airtight against every bypass. That part's still on you.
Checks, alerts and status pages in one workspace. Now in early access: join the list for an invite.