Header grades and certificates
ยท Open
This page is supposed to carry a header grade and a certificate status for every surface in the network, produced with the headers and cert tools.
Not written yet, waiting on V-1
A per-surface header grade and certificate status. The headers and cert tools are not live, so there is no check to cite, and the DNS provider and registrar for bryancalabro.com are not confirmed in the fact ledger either. Grading headers by eye and calling it a report would be the exact thing this desk is supposed to be an alternative to.
Checked 2026-09-21.
What is configured, which is not the same as what is served
I can say what the configuration asks for. I cannot say what is actually being served until something measures it, and those two differ more often than anyone expects, because a platform can add, strip or override headers between the config and the response.
Each desk in this network ships this:
| Header | Value |
|---|---|
Content-Security-Policy | default-src 'self', styles from self and Google Fonts, fonts from Google Fonts, images from self and data:, connect-src 'self', base-uri 'none', form-action 'none', frame-ancestors 'none' |
X-Content-Type-Options | nosniff |
X-Frame-Options | DENY |
Referrer-Policy | strict-origin-when-cross-origin |
Permissions-Policy | geolocation=(), microphone=(), camera=(), interest-cohort=() |
connect-src 'self' is the load-bearing one. These are static sites with no API of their own, so a future fetch to anywhere else fails loudly rather than quietly succeeding.
The gap in that policy is script-src 'self' 'unsafe-inline', which is there because the theme is applied by a small inline script before first paint to avoid a flash of the wrong theme. A nonce or a hash would close it, and that is the next change to make here rather than a thing to describe as fine.
What a real report needs
- The response headers as actually served, per host, with the date.
- The certificate issuer, expiry and chain, per host.
- The grade, from a named tool with a named version, because grades are not comparable across tools.
- The delta since the last run, which is the only part that ever requires action.
Point four is why this becomes a recurring report rather than a page.
Until then
The threat model is complete and describes what the code actually does, which is a separate question from what the edge is serving.