Free · Server-side scan
Security Headers Checker
Paste a URL. We fetch its response headers safely, grade the high-signal security headers with transparent scoring, and hand you conservative, copy-paste fixes for your stack.
At a glance
- Grade HSTS, CSP, clickjacking protection, Referrer-Policy, Permissions-Policy, and X-Content-Type-Options.
- See exactly why each header passes, is weak, or is missing — and the plain-language impact.
- Copy a hardening baseline for Nginx, Apache, Express/Next.js, Cloudflare Workers, or Netlify/Vercel.
What this means
Headers are guardrails, not a full audit
HTTP security headers tell the browser how to defend your page — force HTTPS, block injected scripts, stop clickjacking, and limit what data leaks to other sites. They are a fast, high-signal baseline, not a replacement for a full security review.
How is the grade calculated?
Scoring is deterministic and visible: CSP is worth 25 points, HSTS 20, clickjacking protection 15, Referrer-Policy 15, Permissions-Policy 15, and X-Content-Type-Options 10 — 100 total. A header that is present-and-strong earns full points, a weak one earns half, and a missing one earns zero. Letter grades are A+ (95+), A (85+), B (70+), C (55+), D (40+), otherwise F.
Why are the CSP suggestions so cautious?
A bad Content-Security-Policy can silently break a site, and an over-broad one gives no protection. We suggest a strict starter policy and tell you to deploy it as Content-Security-Policy-Report-Only first, so you can widen sources until nothing legitimate is blocked before enforcing it.
What about HSTS includeSubDomains and preload?
They are powerful but risky: includeSubDomains forces HTTPS on every subdomain, and preload bakes your domain into browsers and is very hard to reverse. The baseline sets a one-year max-age only and warns you to add those flags manually, after confirming every subdomain serves HTTPS.
Are checked URLs stored?
No. The server fetches your public response headers in memory because browser CORS rules usually block direct checks. Requests run through private-network, DNS, timeout, redirect, and response-size protections, and nothing you submit is saved.