Security headers checker

Paste a host name and we fetch its home page exactly as a browser would, following redirects, and grade the HTTP response headers. The scale is the one securityheaders.com made familiar: six headers are scored and your grade is simply how many are present, from A+ for all six down to F for none. A Content-Security-Policy that allows inline or remote script caps the grade at A.

The six scored headers

• Strict-Transport-Security tells browsers to use HTTPS only, for as long as max-age says. Recommended: max-age=31536000; includeSubDomains. Not scored when the page is served over plain HTTP.
• Content-Security-Policy says where scripts, styles, frames and other resources may load from, which is the strongest defence against cross-site scripting. Start with default-src 'self' and add sources as needed. Avoid 'unsafe-inline' in script-src; use nonces or hashes instead.
• X-Frame-Options stops other sites framing yours (clickjacking). SAMEORIGIN or DENY. A CSP frame-ancestors directive counts instead.
• X-Content-Type-Options with the only valid value, nosniff, stops browsers guessing content types.
• Referrer-Policy controls how much of the current URL leaks in the Referer header when a visitor follows a link. strict-origin-when-cross-origin is a safe default.
• Permissions-Policy switches off browser features your site does not use, such as camera, microphone or geolocation, so an injected script cannot use them either.

How to add them

Most sites set these in one place: the web server (nginx add_header, Apache Header always set), the CDN or edge (Cloudflare Transform Rules, Netlify _headers, Vercel headers in vercel.json), or the application framework (Helmet for Node, SecurityMiddleware in Django, secure_headers in Rails). Add them one at a time, reload the page, and re-run this check; the grade moves one letter per header.

What the grade does not measure

Headers are a cheap, high-value layer, but a perfect A+ says nothing about the certificate, the TLS configuration or the software behind the site. Pair this check with our certificate report, and for a full policy review run the HTTP Observatory scan, which weighs the quality of each policy rather than its presence.