Security Headers Checker
Scan any website's HTTP response headers and get an instant A+ to F security grade β HSTS, CSP, X-Frame-Options and more, with a fix for anything missing.
Enter any public domain or URL. We fetch it once from the edge and grade its response headers β nothing is stored.
WHAT WE CHECK
The six headers that decide your grade
Each one closes a specific class of attack. Here's what they do and why they matter.
Forces browsers to use HTTPS only, blocking downgrade and cookie-hijacking attacks. Add it with a max-age of at least 6 months.
Controls which scripts, styles and resources may load β the strongest defense against cross-site scripting (XSS) and injection.
Stops browsers from MIME-sniffing responses, which can turn an uploaded file into executable script. Set it to nosniff.
Prevents your pages from being embedded in other sites' frames, blocking clickjacking. Use X-Frame-Options or CSP frame-ancestors.
Controls how much of your URL is sent to other sites when users click links, protecting private paths and tokens.
Restricts which browser features (camera, microphone, geolocation, and more) a page and its embeds are allowed to use.
FREQUENTLY ASKED