Website security headers check
Security headers protect your visitors from clickjacking, traffic interception and other attacks. Enter a website address and get a grade from A+ to F with an explanation of what is missing.
Which security headers are checked
The checker requests the page and reads six HTTP response headers that browsers use to protect visitors: Strict-Transport-Security (forces HTTPS), Content-Security-Policy (limits where scripts and other resources may load from), X-Frame-Options or the CSP frame-ancestors directive (stops the site being framed for clickjacking), X-Content-Type-Options (stops browsers guessing file types), Referrer-Policy (controls what address is passed to other sites) and Permissions-Policy (limits access to the camera, microphone, location and similar features).
The grade counts how many of them are present: all six give A+, five give A, four give B, and so on down to F. The result also shows the full CSP text with its directives and the HSTS details: max-age, includeSubDomains and whether the site meets the preload list requirements.
How to read the grade
- A+ or A: the basics are in place. The next step is to review the CSP itself, because a policy that allows everything still counts as present.
- B or C: one to three headers are missing; each hint under the result explains what the missing header does.
- D to F: the server sends almost no protective headers. On Apache most of them can be added with a few lines in .htaccess.
- HSTS preload eligible: max-age of at least one year, includeSubDomains and the preload flag are all present.
Related errors and guides
- How to add security headers in .htaccess
- What Content-Security-Policy is
- What HSTS is
- Refused to display in a frame: X-Frame-Options
- HSTS preload submission rejected
Frequently asked questions
- Can adding headers break my site?
- HSTS and CSP can. HSTS makes browsers use HTTPS only for the whole max-age period, so make sure every subdomain works on HTTPS first. A strict CSP blocks scripts it does not list, so start with Content-Security-Policy-Report-Only and tighten it step by step.
- Does the grade check that my CSP is good?
- No, the grade counts headers that are present. The full CSP text is shown so you can review it, but deciding whether a policy is strict enough is up to you.
- Why do I get a different grade on another page?
- Headers can differ by path or file type, especially when the application sets them rather than the web server. The check tests the exact address you enter.