Security Headers Checker

Scan a website's HTTP response headers - see its grade and which security headers are present, weak or missing, with how to fix each one.

Enter a website address to begin.

Reference

Understanding Security Headers

Security headers are instructions a web server sends with every page, telling the browser which protections to switch on. They cost nothing to add and close off whole classes of attack that the site's own code cannot prevent by itself.

Strict-Transport-Security (HSTS): Tells a browser to use HTTPS for every future visit, even if a link or the visitor types http://. Without it, an attacker on the same network can silently downgrade the first request.
Content-Security-Policy (CSP): A list of the places a page may load scripts, styles, images and frames from. It is the main defence against cross-site scripting: an injected script that is not on the list simply does not run.
X-Frame-Options / frame-ancestors: Stops other sites from showing your page inside an invisible frame and tricking visitors into clicking on it (clickjacking). The CSP directive frame-ancestors is the modern form; X-Frame-Options is the older one. Either is enough.
X-Content-Type-Options: With the value nosniff, the browser trusts the file type the server declares instead of guessing from the contents - so an uploaded image that is really a script is not executed.
Referrer-Policy: Controls how much of the current page address is passed along when a visitor follows a link or the page loads something from another site. A strict setting keeps private paths and query strings from leaking.
Permissions-Policy: Switches off browser features the site does not use - camera, microphone, location, payment - for the page and anything embedded in it.
How the grade is worked out: Each header carries points: HSTS and CSP 25 each, clickjacking protection and X-Content-Type-Options 15 each, Referrer-Policy and Permissions-Policy 10 each. A correctly set header earns all of its points, a weak one half, a missing one none. 100 is A+, 85 and up A, 70 B, 55 C, 35 D, below that F. A site that is not served over HTTPS is always F.
What this check sees: The headers on the site's home page as a first-time visitor without cookies would receive them, after following redirects. Other pages, logged-in areas and API responses can send different headers.

Headers protect the browser; the certificate and TLS setup protect the connection. For that side, see SSL Analyzer.