Security Headers Checker
Grade a site's HTTP security headers in seconds.
Public URLs only. The scan reads response headers — it does not test for vulnerabilities.
HTTP Security Headers — Remediation Guide
Per-header remediation with copy-paste config for Nginx, Apache, Cloudflare Workers and Vercel.
One email, no spam, unsubscribe any time.
About this tool
This scanner performs a server-side request to the URL you provide and inspects the response headers that protect users from clickjacking, MIME sniffing, protocol downgrade and injection attacks. Each header is scored and the overall grade reflects how many critical protections are present.
Which HTTP security headers matter most
Strict-Transport-Security forces HTTPS. Content-Security-Policy is the strongest defence against cross-site scripting. X-Content-Type-Options stops MIME sniffing. X-Frame-Options or CSP frame-ancestors blocks clickjacking. Referrer-Policy and Permissions-Policy limit data leakage and browser feature access.
How to fix a failing grade
Add the missing headers at the edge — reverse proxy, CDN or hosting platform — so every response carries them. Roll out Content-Security-Policy in report-only mode first to catch legitimate resources before enforcing it.
How to use Security Headers Checker
- 1
Enter a public URL
Include the scheme, e.g. `https://example.com`. The scan follows redirects and grades the final response.
- 2
Read the grade
The score weighs six headers that materially reduce XSS, clickjacking, MIME-sniffing and downgrade attacks.
- 3
Fix the red rows
Each missing header comes with concrete advice — apply it in your proxy, framework middleware or CDN rules.
- 4
Re-scan
Re-run after deploy to confirm the header reaches the browser and is not stripped by a cache layer.
Example input
https://example.com
Expected output
Grade B · 72/100 — missing Content-Security-Policy and Permissions-Policy
Best practices
- Start Content-Security-Policy in report-only mode, collect violations for a week, then enforce — a blind rollout will break third-party scripts.
- Set `Strict-Transport-Security: max-age=31536000; includeSubDomains` only once every subdomain is HTTPS-ready, then consider preload.
- Prefer `X-Content-Type-Options: nosniff` and a restrictive `Referrer-Policy` (`strict-origin-when-cross-origin`) as safe day-one wins.
- Use `frame-ancestors` in CSP rather than legacy `X-Frame-Options` for new deployments; ship both while old browsers matter.
- Set headers at the edge (CDN, reverse proxy) so every app and static asset inherits them consistently.
Why Security Headers Checker matters
Response headers are the cheapest security control you can ship: no code changes, no dependencies, and they mitigate whole classes of client-side attacks.
Missing headers routinely surface in penetration tests, vendor security questionnaires and SOC 2 reviews — fixing them removes friction from enterprise sales.
Related free & paid tools
| Tool name | Type | Key features | Link |
|---|---|---|---|
| SecurityHeaders.com | Free | Header scanner with letter grade and history | Visit |
| Mozilla Observatory | Free | Broader web security scan including TLS | Visit |
| Report URIOffer | Freemium | Collects CSP violation reports at scale | Visit |
| CloudflareOffer | Freemium | Set and enforce headers at the edge for every origin | Visit |
Links marked Offer may be partner links. They cost you nothing extra and never affect which tools we recommend.