Free tool
Security headers check
Enter a website and get an A+ to F grade for its security headers in seconds, with the exact line to add for your server.
We fetch the public page once to read its headers and don't store it. Results are cached for an hour.
Your badge
Want your headers, TLS and email security re-checked every week and shared with customers as one verified profile?
What security headers are
Every time a browser loads a page, the server sends a set of HTTP response headers along with it. A handful of them tell the browser how to protect the visitor: only ever use HTTPS, refuse to run scripts from unknown places, don't let other sites frame the page, and don't leak the full address of the page to other sites. They cost nothing to add, they don't change how the site looks, and they block whole classes of attack.
What this check looks at
- HTTPS and the redirect from HTTP. The site should answer on HTTPS and send anyone who types the plain address there.
- Strict-Transport-Security (HSTS). Tells browsers to use HTTPS only, for a period you choose. We look for at least 6 months (max-age=15552000) and includeSubDomains.
- Content-Security-Policy (CSP). Lists where scripts, styles and frames may come from, so an injected script is refused. We warn when the policy allows 'unsafe-inline', 'unsafe-eval' or wildcard sources for scripts, which undo most of that protection.
- X-Content-Type-Options: nosniff. Stops browsers guessing that an uploaded text file is really a script.
- Clickjacking protection. CSP frame-ancestors, or the older X-Frame-Options, stops other sites loading your page in an invisible frame to trick clicks.
- Referrer-Policy. Controls how much of your page address is sent to other sites. Addresses often contain search terms, IDs or reset tokens.
- Permissions-Policy. Switches off browser features your site never uses, such as the camera, microphone and location.
- Cookies. Cookies set on the page should carry Secure, HttpOnly and SameSite so they can't be read by scripts, sent over HTTP or attached to requests from other sites.
- Version disclosure. Server and X-Powered-By headers that announce exact software versions make it easy to match known exploits.
How the grade is worked out
The score is out of 100 and every point is listed in the table below. Warnings earn part of the points, failures earn none, and each header that reveals software versions takes off 5 points (at most 10). A+ needs 95 or more with no failures.
| Check | Points | Partial credit |
|---|---|---|
| HTTPS, and HTTP redirects to it | 10 | None |
| Strict-Transport-Security | 20 | 14 if max-age or includeSubDomains is missing, 8 if both |
| Content-Security-Policy | 25 | 15 with unsafe script sources, 5 for report-only |
| X-Content-Type-Options | 10 | None |
| Clickjacking protection | 10 | None |
| Referrer-Policy | 10 | 4 if missing, 3 if it leaks full URLs |
| Permissions-Policy | 5 | None |
| Cookie flags | 10 | Minus 4 for each cookie missing a flag |
| Version disclosure | −5 each | At most −10 |
Grades: A+ 95 or more with no failures, A 85+, B 70+, C 55+, D 40+, F below 40.
How to fix the common problems
Most sites can reach an A in an afternoon. Add the simple headers first (nosniff, Referrer-Policy, Permissions-Policy, frame protection), then HSTS. Start HSTS with a short max-age, check every subdomain works on HTTPS, then raise it to a year; once browsers have seen a long max-age you can't easily go back.
CSP takes the most care. Begin with Content-Security-Policy-Report-Only so nothing breaks, read the reports for a week, then switch to an enforced policy. Replace inline scripts with files or hashes rather than allowing 'unsafe-inline'. Each finding above has the exact line for nginx, Apache, Cloudflare, Vercel and Netlify.
Who this matters to
Security questionnaires from enterprise buyers, banks and government departments ask about these headers by name, and India's GIGW guidelines and CERT-In audits check them. Strong headers are also a quick, visible signal to customers that the basics are handled. Put the badge in your README or footer to show it.
FAQ
Questions
Is this check safe to run on my site?
Yes. It makes one normal GET request, as a browser would, and follows up to 5 redirects. It doesn't crawl, log in or test for vulnerabilities.
Why did my site get a different grade elsewhere?
Other checkers weight headers differently. Every point here is shown in the scoring table, so you can see exactly why you got your grade.
Which header matters most?
Content-Security-Policy, because it limits the damage from cross-site scripting. HSTS is a close second: it's simple and stops HTTPS being downgraded.
Will adding a CSP break my site?
It can if inline scripts or third-party resources aren't listed. Start in report-only mode, fix what's reported, then enforce it.
Can I check a site on my internal network?
No. Only public websites can be checked; private, internal and reserved addresses are refused.
How often does the badge update?
At most once a day. Results on this page are cached for an hour.
Do you store the pages you check?
No. We read the response headers and discard the page. We keep only daily counts of how often the tool is used.