Does this scan test for vulnerabilities?

No. It inspects response headers only. It is a hygiene check, not a penetration test.

Why did the scan fail for my site?

The URL must be publicly reachable over HTTP or HTTPS. Sites behind a VPN, a login wall or aggressive bot protection may refuse the request.

Is a perfect grade required?

No. Prioritise HSTS, CSP and X-Content-Type-Options; the remaining headers are quick wins once those are in place.

How do I check the security headers of a website?

Paste the full URL into the checker above. It performs a live request, lists every security header the server returned, flags what is missing, and gives you the exact configuration line to add.

Which security headers are most important?

Content-Security-Policy and Strict-Transport-Security do the most work, followed by X-Content-Type-Options: nosniff and frame protection via X-Frame-Options or CSP frame-ancestors.

What does the nosniff header do?

X-Content-Type-Options: nosniff tells the browser to trust the declared Content-Type instead of guessing, which prevents an uploaded file from being executed as a script.

Will adding a Content-Security-Policy break my site?

It can if you enforce it immediately. Deploy it as Content-Security-Policy-Report-Only first, review the violation reports for a week, then switch to enforcement.

Is X-XSS-Protection still recommended?

No. Modern browsers ignore it, and its legacy filter caused its own vulnerabilities. Remove it and rely on a proper Content-Security-Policy.

Do I need HSTS if my site already redirects to HTTPS?

Yes. The very first request in a redirect still travels over plain HTTP, and that is the request an attacker intercepts. HSTS removes that window on every subsequent visit.

Can I scan an internal or password-protected site?

No — the check runs against a publicly reachable URL. For internal hosts, inspect the headers with curl -I from inside the network and compare them with the table above.

Security & Infrastructure

Security Headers Checker: Instantly Enhance Your Website's Security

Grade a site's HTTP security headers in seconds.

Enter any public URL and this security headers checker fetches the response headers and grades them against current best practice: Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy. You get a letter grade, the exact value each header returned, and the specific line to add for anything missing.

Public URLs only. The scan reads response headers — it does not test for vulnerabilities.

HTTP Security Headers — Remediation Guide

Per-header remediation with copy-paste config for Nginx, Apache, Cloudflare Workers and Vercel.

One email, no spam, unsubscribe any time.

About this tool

This scanner performs a server-side request to the URL you provide and inspects the response headers that protect users from clickjacking, MIME sniffing, protocol downgrade and injection attacks. Each header is scored and the overall grade reflects how many critical protections are present.

Which HTTP security headers matter most

Strict-Transport-Security forces HTTPS. Content-Security-Policy is the strongest defence against cross-site scripting. X-Content-Type-Options stops MIME sniffing. X-Frame-Options or CSP frame-ancestors blocks clickjacking. Referrer-Policy and Permissions-Policy limit data leakage and browser feature access.

How to fix a failing grade

Add the missing headers at the edge — reverse proxy, CDN or hosting platform — so every response carries them. Roll out Content-Security-Policy in report-only mode first to catch legitimate resources before enforcing it.

What each security header actually protects against

Content-Security-Policy is the single highest-impact header: it tells the browser which script, style and frame sources are legitimate, which turns most cross-site scripting bugs from a full account takeover into a blocked console error. Strict-Transport-Security forces every future visit over HTTPS, defeating downgrade attacks and cookie interception on hostile networks. X-Content-Type-Options: nosniff stops the browser guessing a MIME type and executing a user-uploaded file as JavaScript. X-Frame-Options (or CSP's frame-ancestors) prevents clickjacking by refusing to render your pages inside someone else's iframe. Referrer-Policy stops full URLs — often containing tokens or IDs — leaking to third parties. Permissions-Policy switches off camera, microphone and geolocation APIs you never intended to use.

Rolling out a Content-Security-Policy without breaking the site

Deploy in report-only mode first. Send Content-Security-Policy-Report-Only with your intended policy and a report-uri, leave it for a week, and read what it would have blocked. Start from a restrictive base — default-src 'self' — then add only the origins your reports prove you need. Avoid 'unsafe-inline' for scripts; use nonces or hashes instead, since a policy with unsafe-inline blocks almost nothing. Once the report volume is quiet, switch the header name to Content-Security-Policy to start enforcing.

Getting HSTS right, including preload

A production-ready value is max-age=31536000; includeSubDomains; preload — one year, covering every subdomain, and eligible for the browser preload list. Build up to it: start with max-age=300 to prove nothing breaks, then raise it. The commitment is real, because includeSubDomains will break any subdomain still served over plain HTTP, and removing yourself from the preload list takes months. Never send HSTS over HTTP; browsers ignore it there.

Apply headers once, at the edge

Setting headers in application code means every new service has to remember them. Configure them instead at the shared layer — the CDN, reverse proxy, ingress controller or base image — so every hostname inherits the same baseline, and override per-application only where a page genuinely needs a looser policy. Then re-run this checker after each deploy: header configuration drifts silently when someone adds a new route, a new CDN behaviour or a new subdomain.

Headers you should be removing

Response headers that advertise your stack — Server with a full version string, X-Powered-By, X-AspNet-Version — give an attacker a shortcut to a matching exploit and buy you nothing. Strip them at the proxy. X-XSS-Protection is obsolete and should be removed rather than set, since modern browsers ignore it and its legacy filter introduced vulnerabilities of its own.

Recommended HTTP security header values

Header	Recommended value	Protects against
Content-Security-Policy	default-src 'self'; object-src 'none'; frame-ancestors 'none'; base-uri 'self'	Cross-site scripting, data injection
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload	Protocol downgrade, cookie hijacking
X-Content-Type-Options	nosniff	MIME-type confusion attacks
X-Frame-Options	DENY	Clickjacking (legacy browsers)
Referrer-Policy	strict-origin-when-cross-origin	URL and token leakage
Permissions-Policy	camera=(), microphone=(), geolocation=()	Unwanted device API access
Cross-Origin-Opener-Policy	same-origin	Cross-window attacks, Spectre
Cross-Origin-Resource-Policy	same-origin	Cross-origin resource leaks

How the grade is calculated

Grade	Meaning
A	All critical headers present with strong values
B	Critical headers present, one or two weak values
C	CSP or HSTS missing
D	Multiple critical headers missing
F	Essentially no security headers configured

How to use Security Headers Checker

1
Enter a public URL
Include the scheme, e.g. `https://example.com`. The scan follows redirects and grades the final response.
2
Read the grade
The score weighs six headers that materially reduce XSS, clickjacking, MIME-sniffing and downgrade attacks.
3
Fix the red rows
Each missing header comes with concrete advice — apply it in your proxy, framework middleware or CDN rules.
4
Re-scan
Re-run after deploy to confirm the header reaches the browser and is not stripped by a cache layer.

Example input

https://example.com

Expected output

Grade B · 72/100 — missing Content-Security-Policy and Permissions-Policy

Best practices

Start Content-Security-Policy in report-only mode, collect violations for a week, then enforce — a blind rollout will break third-party scripts.
Set `Strict-Transport-Security: max-age=31536000; includeSubDomains` only once every subdomain is HTTPS-ready, then consider preload.
Prefer `X-Content-Type-Options: nosniff` and a restrictive `Referrer-Policy` (`strict-origin-when-cross-origin`) as safe day-one wins.
Use `frame-ancestors` in CSP rather than legacy `X-Frame-Options` for new deployments; ship both while old browsers matter.
Set headers at the edge (CDN, reverse proxy) so every app and static asset inherits them consistently.

Security Headers Checker — Why it matters

Response headers are the cheapest security control you can ship: no code changes, no dependencies, and they mitigate whole classes of client-side attacks.

Missing headers routinely surface in penetration tests, vendor security questionnaires and SOC 2 reviews — fixing them removes friction from enterprise sales.

Related free & paid tools

Tool name	Type	Key features	Link
SecurityHeaders.com	Free	Header scanner with letter grade and history	Visit
Mozilla Observatory	Free	Broader web security scan including TLS	Visit
Report URIOffer	Freemium	Collects CSP violation reports at scale	Visit
CloudflareOffer	Freemium	Set and enforce headers at the edge for every origin	Visit

Some links marked Offer are partner links. They cost you nothing extra and help keep these tools free.