Security Headers Checker

Security headers are short instructions a website sends to every browser, telling it to refuse risky behaviour. Enter an address and we read the headers the way a browser receives them, grade the result from A+ to F and show the exact fix for every gap.

What security headers do

When a browser loads a page, the server can add extra headers to the response. Security headers do not change how the page looks. They switch on protections inside the browser: forcing encrypted connections, blocking injected scripts, stopping other sites from framing your page and limiting what is shared with third parties. They cost nothing, take a few lines of server configuration and close whole families of attacks.

What we check

• HTTPS: whether the address ends up on an encrypted connection at all.
• Strict-Transport-Security (HSTS): tells browsers to use HTTPS only, so a visitor on public Wi-Fi cannot be quietly downgraded to HTTP. We look for a lifetime of at least 180 days.
• Content-Security-Policy (CSP): lists where scripts, styles and frames may load from. It is the strongest defence against cross-site scripting. We flag policies that allow unsafe-inline, unsafe-eval or scripts from anywhere.
• X-Content-Type-Options: the value nosniff stops browsers from guessing file types.
• Clickjacking protection: X-Frame-Options or the CSP frame-ancestors directive, so your page cannot be hidden inside another site’s frame.
• Referrer-Policy: controls how much of your page address is passed to other sites when a visitor clicks a link.
• Permissions-Policy: switches off browser features such as camera, microphone and location that the page does not need.
• Server information: headers such as Server, X-Powered-By and X-AspNet-Version that announce software versions to anyone who asks.
• Cookie flags: if the page sets cookies, whether they carry Secure, HttpOnly and SameSite.

How the grade works

Each check has a weight. The most important ones, CSP and HSTS, count the most. A passing check earns its full weight, a warning earns a part of it and a missing header earns nothing. The total becomes a score out of 100 and then a grade. A page that is not served over HTTPS always gets an F, because no header can make plain HTTP safe. An A+ needs a near-perfect score with both HSTS and CSP in good shape.

The grade is a quick health check, not a security audit. A site can have perfect headers and still have vulnerable code, and a site with a lower grade can be well built. Use it to find cheap, safe improvements.

How to add the missing headers

Where you set headers depends on the server. These examples cover a sensible starting set.

nginx

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

IIS (web.config)

<system.webServer>
  <httpProtocol>
    <customHeaders>
      <add name="X-Content-Type-Options" value="nosniff" />
      <add name="X-Frame-Options" value="SAMEORIGIN" />
      <add name="Referrer-Policy" value="strict-origin-when-cross-origin" />
      <remove name="X-Powered-By" />
    </customHeaders>
  </httpProtocol>
</system.webServer>

Roll out Content-Security-Policy carefully. Start with Content-Security-Policy-Report-Only so the browser reports what it would block without breaking anything, fix the reports, then switch to the enforcing header. Add Strict-Transport-Security only once every subdomain you list supports HTTPS.

About this tool

Our server requests the address you enter (over HTTPS first, following up to five redirects) and returns the headers of the final page. The grading runs in your browser. To protect the service, we only reach public websites on the standard web ports, never private or internal addresses, we do not download the page itself, and the tool is rate limited. Nothing you enter is stored. Because the headers come from one request, a site that sends different headers to different visitors or to logged-in users can look different here. To follow where an address leads first, use the redirect checker.

Frequently asked questions

What is a good security headers grade?

An A or A+ means all the important headers are present and well configured. B is good with a few gaps. Most sites that have never been hardened score D or F, so even reaching B is a clear improvement.

Do I need every security header?

The most valuable are HTTPS with HSTS, Content-Security-Policy, X-Content-Type-Options and clickjacking protection. Referrer-Policy and Permissions-Policy are smaller improvements. Cookie flags matter if your site sets cookies, for example for logins.

Will adding a Content-Security-Policy break my website?

It can, because it blocks anything not on its list, including inline scripts and third-party widgets. Start with the Report-Only version, review what it reports, adjust the policy and only then enforce it.

Why does the result differ from another header scanner?

Scanners weigh the headers differently and may request a different address. Some send different headers to browsers than to automated tools. We grade the headers of the final page after redirects, as one browser request would receive them.

Does this tool test my site for vulnerabilities?

No. It only reads response headers. It cannot find flaws in your code or server software, and a good grade does not mean the site is secure. Treat it as a quick, free first check.

Why is my site marked F when I use HTTPS?

With HTTPS but none of the other headers, most of the weighted checks fail and the score is low. Add HSTS, a Content-Security-Policy, nosniff and a frame protection header and the grade rises quickly.

Related tools and guides

• Redirect checker: trace every hop to the final page.
• SSL certificate checker: is the certificate valid.
• Response time test: how fast the server answers.
• SEO meta tag checker: title, description, Open Graph.

← Run the speed test · All tools · All guides