A or better is a reasonable goal for public websites. Most major sites (Google, GitHub, Stripe) score A or A+.

Why does HSTS matter?

HSTS tells browsers to only connect over HTTPS. Without it, an attacker on a shared network can downgrade the first connection to HTTP and steal credentials before redirects kick in.

Security Headers Checker

Mozilla-style scoring for CSP, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy.

Security Headers Checker

Score a site's security headers