What this checks
The checker sends one request to the URL you enter and reports every HTTP response header the server returned — content type, caching, server software, cookies, and the security headers below. Redirects are not followed, so you see the headers for exactly the URL you asked about, not wherever it might point next. Multi-value headers are joined into a single line.
On top of the raw list, it grades six well-known security headers and gives you a single letter from A to F based on how many are present. The grade is a fast signal, not a full audit — a header being present says nothing about whether its value is well-configured.
How to read the results
The grade badge at the top counts how many of the six security headers are present: all six earns an A, five a B, three or four a C, two a D, one an E, and none an F. Below it, each security header is marked Present or Missing with a one-line note on what it protects. The full header list follows, capped for readability with a "show all" toggle when a site returns a long list.
The security headers that matter
Strict-Transport-Security (HSTS) tells browsers to only ever reach your site over
HTTPS, for a duration you set with max-age. Once a browser has seen it, it refuses to
connect over plain HTTP at all — closing the window where a first, insecure request could be
intercepted and redirected. It's one of the highest-value headers you can add.
Content-Security-Policy (CSP) is the most powerful — and the most finicky. It declares exactly which sources a page may load scripts, styles, images, and frames from, which is the strongest defense against cross-site scripting. It's also the header most likely to break a working site if set too tightly, which is why so many sites don't have one. Start in report-only mode.
X-Frame-Options controls whether other sites can embed your pages in a frame,
blocking clickjacking attacks that overlay an invisible copy of your site over a decoy. DENY
or SAMEORIGIN are the usual values; CSP's frame-ancestors is the modern
successor, but this header still covers older browsers.
X-Content-Type-Options: nosniff stops browsers from second-guessing the
Content-Type you send and "sniffing" a response as something else — for example
executing a user-uploaded file as a script. It's a single fixed value with no downside, so a missing
one is nearly always an easy win.
Referrer-Policy governs how much of the current URL is sent in the
Referer header when a visitor follows a link away from your site — which can leak
internal paths or tokens. Permissions-Policy lets you switch off browser features
(camera, microphone, geolocation, and more) that your site doesn't use, shrinking what a compromised
script could reach.
FAQ
Which security headers matter most?
If you're starting from nothing, add HSTS and X-Content-Type-Options: nosniff first —
both are high-value, low-risk, and hard to get wrong. Then X-Frame-Options and Referrer-Policy.
Content-Security-Policy is the most protective but needs the most care, so tackle it deliberately
rather than last-minute.
Will adding CSP break my site?
It can, if it's stricter than what your pages actually load — an overlooked analytics script or
inline style will simply stop working. The safe path is Content-Security-Policy-Report-Only,
which reports violations without enforcing them. Watch the reports, widen the policy until it's
clean, then switch to the enforcing header.
What grade should I aim for?
A or B is a realistic target for most sites. Getting there means present, sensibly-configured HSTS, X-Content-Type-Options, X-Frame-Options, and Referrer-Policy, plus a Permissions-Policy — and ideally a CSP once you've tuned it. Remember the grade only counts presence; a present-but-weak value still needs review.
Why do headers differ between paths?
Because headers are set per response, not per site. A CDN or app framework can attach different headers to the homepage, an API route, and a static asset — or add them at the edge for some paths and not others. If a result surprises you, check the exact URL; the homepage isn't always representative of the whole site.