Security Headers Checker

Scan and grade your HTTP security headers

Security headers are short instructions your server sends with every page. They tell the browser to always use HTTPS, which scripts are allowed to run, whether the page may be framed by other sites and how much information to leak to other websites. They cost nothing, work in every modern browser and block whole classes of attacks such as cross-site scripting, clickjacking and protocol downgrades. This checker requests your page, grades the headers from A+ to F and tells you exactly what to add.

What the scan covers

• Content-Security-Policy: checks for unsafe-inline, unsafe-eval, wildcards and missing object-src and base-uri.
• Strict-Transport-Security: max-age length, includeSubDomains and preload readiness.
• Clickjacking: X-Frame-Options or the CSP frame-ancestors directive.
• Hardening headers: X-Content-Type-Options, Referrer-Policy, Permissions-Policy and the cross-origin policies COOP, CORP and COEP.
• Leaks and hygiene: server version numbers, X-Powered-By, cookies without Secure, HttpOnly or SameSite, a missing HTTP to HTTPS redirect and outdated headers.

A transparent score

Each header has a fixed weight and the result table shows how many points it earned and why, so you always know which change moves the grade. Strong values get full points, weak values part of them, and a missing header none. Penalties for leaks, cookies and redirects are listed separately.

Fixing the headers

Every header comes with a recommended value you can copy, and the snippet generator writes the missing ones for nginx, Apache, Cloudflare Transform Rules, a _headers file for Netlify or Cloudflare Pages, and vercel.json. Roll out a Content-Security-Policy in report-only mode first, and only add HSTS preload once every sub-domain serves HTTPS. Share the result link with your developer or export the full report as JSON.