Security Headers Checker

About Security headers checker

This tool requests a page and grades its HTTP response headers from A+ to F on a 100 point scale. It checks Content-Security-Policy, HSTS, X-Frame-Options, Referrer-Policy and other browser protections, and it scores weak values, not just missing ones. Site owners and reviewers use it to see what to fix first.

How to use it

1. Enter the site address in the Website URL field.
2. Select Grade Headers. The address is sent to our server, which makes one request and reads the headers.
3. Read the letter grade, the score out of 100 and the final URL and status shown beside it.
4. Open the Header breakdown and read each row's Pass, Weak or Fail badge and notes.
5. Add or tighten the flagged headers on your server, then run the check again.

Some headers, some weaknesses

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload, Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline', X-Content-Type-Options: nosniff

Grade D, 43 of 100. HSTS 20/20 and X-Content-Type-Options 10/10 pass. The CSP is Weak at 12.5/25 because script-src allows unsafe-inline. The other six headers are missing and fail.

When to use it

• Auditing a site before launch to make sure the basic browser protections are in place.
• Showing a client why a policy containing unsafe-inline gives little protection against script injection.
• Verifying that a change to your CDN or reverse proxy did not remove headers.
• Comparing staging and production responses for one application.

Questions about Security headers checker

How is the score weighted?

Content-Security-Policy carries 25 points, HSTS 20, X-Frame-Options 15, X-Content-Type-Options, Referrer-Policy and Permissions-Policy 10 each, Cross-Origin-Opener-Policy 5, Cross-Origin-Resource-Policy 3 and Cross-Origin-Embedder-Policy 2.

What are the grade cutoffs?

A+ starts at 95, A at 85, B at 70, C at 55 and D at 40. Anything below 40 is an F, which is what a response with no security headers receives.

Why is a present header marked Weak?

Because presence alone does not help. A CSP with a wildcard or unsafe-inline, or an HSTS max-age of a few minutes, is present yet still leaves the risk open, so it earns partial credit.

Which page does it grade?

Whatever the address returns after up to five redirects, using a normal GET request. Headers can differ between pages, so check important routes such as login separately.

Does a top grade mean the site is secure?

No. Headers are one layer of defense. They do nothing about application bugs, weak authentication or outdated software behind them.

Related tools

• Password Strength CheckerCheck the strength of a password
• Safe URL CheckerCheck if a URL is safe to visit
• HSTS preload checkerCheck whether a domain meets the HSTS preload eligibility criteria.
• Meta Tags CheckerCheck meta tags on a webpage
• File MIME Type CheckerCheck the MIME type of a file
• Gravatar CheckerCheck if an email has a Gravatar