What we check
13+ headers, graded individually
HSTS
Strict-Transport-Security: validates max-age ≥ 31536000, includeSubDomains, and preload readiness. The #1 header for stopping SSL-stripping attacks.
Content-Security-Policy
Full CSP directive analysis: flags unsafe-inline, unsafe-eval, wildcard sources, and missing object-src/frame-ancestors. The primary XSS defense.
X-Frame-Options
Clickjacking protection: checks for DENY or SAMEORIGIN. Notes when frame-ancestors in CSP supersedes it (the modern approach).
X-Content-Type-Options
Must be nosniff — stops browsers from MIME-sniffing responses into executable content. One of the easiest wins in web security.
Referrer-Policy
Controls how much URL information leaks to third parties on navigation. Recommends strict-origin-when-cross-origin or stricter.
Permissions-Policy
Restricts powerful browser features (camera, microphone, geolocation, payment). Most sites should disable everything they don't use.
Cross-Origin policies
COOP, COEP, and CORP — the trio that enables cross-origin isolation, required for SharedArrayBuffer and high-resolution timers.
And 6 more
Expect-CT, X-XSS-Protection (legacy), X-Permitted-Cross-Domain-Policies, Clear-Site-Data guidance, and server information-leakage checks.
Why it matters
The highest-ROI defense you're not using
Our scans show most websites fail basic header checks — missing HSTS, no CSP, clickjacking wide open. These aren't exotic vulnerabilities; they're configuration lines your CDN or web server can add in minutes, for free, with zero visual change to your site. A tight CSP alone neutralizes the most common web vulnerability class (XSS). HSTS closes the door on an entire category of network attacks. If you're doing one security task this week, make it this one.
Live headers
Reads your actual HTTP responses — not guesses. What you see is what attackers see.
Exact fix values
Every failure shows the precise header value to add, ready to paste into nginx, Apache, or Cloudflare.
Zero-risk order
Fixes ranked by breakage risk — start with the safe ones, test CSP in report-only mode first.
How it works
What happens when you run the check
Enter any URL and the checker makes a real HTTPS request to your server — exactly like a visitor's browser would — and captures every response header. No caching, no user-agent tricks. We analyze the raw headers against current best practice (OWASP Secure Headers Project, 2026 edition) and grade each one.
HSTS deep-dive. We don't just check presence — we parse max-age numerically (must be ≥ 31,536,000 for preload eligibility), verify includeSubDomains, and check whether you qualify for the HSTS preload list. A 6-month max-age gets a warning, not a pass — attackers only need one unprotected window.
CSP directive audit. Your Content-Security-Policy is tokenized directive by directive. We flag unsafe-inline and unsafe-eval in script-src, wildcard sources (https: or *), missing object-src and base-uri, and whether frame-ancestors properly replaces X-Frame-Options. A CSP that allows everything is worse than none — it creates false confidence.
Information leakage scan. Beyond the security headers, we check what your responses reveal: verbose Server headers (Apache/2.4.41 with version = free reconnaissance), X-Powered-By disclosures, and missing X-Content-Type-Options: nosniff which lets attackers MIME-sniff your uploads into executables.
Reading your grade
What the A–F grade actually means
- A — HSTS with 1-year+ max-age, enforced CSP without unsafe directives, all framing/MIME/referrer controls set. Hardened.
- B — Core headers present but with gaps: CSP in report-only mode, HSTS missing preload, or one or two recommended headers absent.
- C — Partial coverage. Maybe HSTS but no CSP, or basic headers without the modern set (Permissions-Policy, COOP/COEP). The average site lands here.
- D — Critical headers missing: no HSTS, no CSP, clickjacking unprotected. Automated scanners will flag you.
- F — No security headers at all, possibly leaking server versions. Every basic attack class is open.
The 80/20: adding just three headers — Strict-Transport-Security, X-Content-Type-Options: nosniff, and X-Frame-Options: DENY — takes most sites from F to C in under 5 minutes with zero breakage risk. CSP is the bigger project; run it in report-only mode for a week first.
FAQ
Common questions
What does the checker test?
13+ security headers from your live HTTP responses — HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP/COEP/CORP, and more. Each gets pass/warn/fail with the exact value found.
What is HSTS and why does max-age matter?
HSTS forces HTTPS-only connections, blocking SSL-stripping. max-age must be ≥ 31536000 (1 year) for preload eligibility. Shorter values leave attack windows.
What should my CSP look like?
Start with default-src 'self', limit script-src to trusted sources (no unsafe-inline), set object-src 'none' and frame-ancestors 'none'. Test in report-only mode first.
Do headers actually stop attacks?
Yes — HSTS blocks downgrade attacks, CSP is the primary XSS defense, X-Frame-Options stops clickjacking. Free to deploy, minutes to add, zero visual change.
Is it really free?
Yes — no signup, no card, no limits. Same engine as our paid deep scans.
How do I fix failures?
Add the shown header values at your CDN, reverse proxy, or web server. Start with HSTS + X-Content-Type-Options (zero risk), then CSP in report-only mode.
How is this different from securityheaders.com?
We audit individual CSP directives (not just presence), check preload eligibility numerically, scan for Server header leakage, and give exact fix values for nginx/Apache/Cloudflare.
Will headers break my site?
HSTS, nosniff, X-Frame-Options, and Referrer-Policy are zero-risk. CSP needs care: start in report-only mode for a week, whitelist legitimate sources, then enforce.
How many headers is your site missing?
Free check, no signup, results in seconds.
Run the free headers check