Security Headers Checker

Enter a URL to see which HTTP security headers a site sends, what each one protects against, and a letter grade weighted by how much protection each header actually provides.

Where a header is missing, you get the exact line to add — and where one is present but weak, an explanation of why it is not doing the job you might assume.

How it works

Security headers are instructions a server sends telling the browser to enforce restrictions on its own. They cost nothing to add, need no code changes, and shut down entire classes of attack — which is why their absence is such a common finding.

Weighted by what they actually prevent:

• Content-Security-Policy controls which sources may load scripts, styles and frames. It is the single most effective defence against cross-site scripting, and also the hardest to deploy — a policy containing unsafe-inline for scripts gives away most of the benefit, which is why we flag it rather than just noting the header exists.
• Strict-Transport-Security forces HTTPS for future visits. Without it, a visitor's first request can still go over plain HTTP and be intercepted, even on a site that redirects.
• X-Content-Type-Options: nosniff stops browsers guessing a file's type. Without it, an uploaded file that looks like script can be executed as script.
• X-Frame-Options (or CSP's frame-ancestors) prevents your pages being embedded in someone else's, which is how clickjacking works.
• Referrer-Policy limits how much of your URL is leaked to other sites — relevant when URLs contain tokens or identifiers.

Two headers you may expect are deliberately not scored. X-XSS-Protection is obsolete and removed from modern browsers; it could itself introduce vulnerabilities, and the correct value today is 0. Expect-CT is likewise retired, since Certificate Transparency is now enforced by default.

Frequently asked questions