Security headers: what the grade actually measures

The MDN HTTP Observatory grade is not a vulnerability scan. It reads the response headers of your front door and scores whether the browser is told to behave safely: HSTS forces HTTPS, Content-Security-Policy limits where scripts may load from, X-Frame-Options and the frame-ancestors directive stop clickjacking, and the referrer and cookie flags limit what leaks to third parties.

A B or better means the basics are in place. A D or F almost always means one of two things: no Content-Security-Policy at all, or HTTPS that can still be downgraded because HSTS is missing. Both are configuration, not code, and both are fixed in the web server or the CDN in an afternoon.

What the grade cannot tell you: whether the application behind the headers is safe, whether the policy is so permissive that it protects nothing, or whether internal hostnames carry the same headers. That is where a review starts.