Security Headers Checker
Scan a website's HTTP security headers and get a letter grade with concrete fixes - HSTS, CSP, X-Frame-Options and more, checked from our EU servers.
About Security Headers Checker
The Security Headers Checker fetches a URL and inspects the HTTP response headers that harden a site against common web attacks. Each header is worth a weighted number of points; the tool adds them up and turns the total into a familiar A-to-F grade so you can see at a glance how well a site is configured and exactly what is missing.
It checks the headers that matter most in practice: Strict-Transport-Security (HSTS) to force HTTPS, Content-Security-Policy to contain cross-site scripting, X-Content-Type-Options to stop MIME sniffing, X-Frame-Options to block clickjacking, Referrer-Policy to limit referrer leakage, Permissions-Policy to restrict powerful browser features, and Cross-Origin-Opener-Policy for origin isolation. For each one you get its current value if present, or a short piece of advice if it is not.
Security headers are one of the cheapest security wins available: they are a few lines of server configuration yet they neutralise whole classes of attack. This tool is a fast way to audit your own sites before and after a change, or to check a third party before you rely on it. Redirects are followed to the final page and the scan runs server-side from EU infrastructure, so it reflects what a real visitor receives.
How to use it
- 1Enter the full URL of the page to scan, including https://.
- 2Select Scan headers.
- 3Read the letter grade and score, then work down the list of checks.
- 4For any header marked missing, apply the suggested configuration on your web server or CDN.
- 5Re-scan to confirm the grade improves.
Common use cases
- -Auditing your own website's security posture before a launch or review.
- -Verifying a CDN or reverse-proxy change actually added the expected headers.
- -Checking a partner or vendor site before integrating with it.
- -Teaching or documenting secure header configuration with a concrete score.
- -Tracking security-header regressions over time.
Frequently asked questions
- What is a good security headers grade?
- Aim for A or A+. That means HSTS with a long max-age, a Content-Security-Policy, and the anti-sniffing, anti-clickjacking and referrer headers are all set. A grade of C or below means important protections are missing.
- Which security headers are the most important?
- Strict-Transport-Security (HSTS) and Content-Security-Policy carry the most weight because they prevent protocol downgrade and cross-site scripting respectively. X-Content-Type-Options: nosniff and a frame-blocking header are the next priorities.
- Does a missing Content-Security-Policy really matter?
- Yes. A CSP is the strongest defence against cross-site scripting and content injection. Without one, a single injected script can run with full access to the page, so it is heavily weighted in the score.
- Is my site scanned from my browser or your servers?
- The scan runs server-side from our European infrastructure, following redirects to the final page. It sees the same response headers a normal visitor would receive.
- Why did my site score lower than expected?
- Common reasons are an HSTS max-age that is too short, a CSP delivered only in report-only mode, or headers set on the HTML page but not after redirects. Check the per-header advice for the exact gap.