Security Headers Check: Grade Any Website's HTTP Headers
Run a free security headers check on any website. Enter a URL and this security header checker reads the site's HTTP response headers, grades them and lists exactly which protections are missing, such as Strict-Transport-Security, Content-Security-Policy and X-Frame-Options, so you know what to add.
Free · no sign-upWhich security headers we check
A security headers check reads the HTTP response headers your server sends with every page. Security headers tell the browser how to protect your visitors, and missing ones leave common attacks open.
| Header | What it protects against | Recommended setting |
|---|---|---|
| Strict-Transport-Security (HSTS) | Downgrade attacks: forces browsers to always use HTTPS. | max-age=31536000; includeSubDomains |
| Content-Security-Policy | Cross-site scripting (XSS): limits which scripts, styles and images can load. | Start in Report-Only mode, then enforce |
| X-Frame-Options | Clickjacking: stops other sites from framing yours. | DENY or SAMEORIGIN |
| X-Content-Type-Options | MIME sniffing: stops browsers from guessing file types. | nosniff |
| Referrer-Policy | Leaking full URLs to other sites. | strict-origin-when-cross-origin |
| Permissions-Policy | Unwanted use of browser features such as the camera or location. | Turn off features you don't use |
| Server | Version details, such as Apache/2.4.41, help attackers pick exploits. | Hide version numbers |
How to check security headers
- Enter the website address, such as https://example.com.
- Press Scan headers.
- Review the grade and each missing header.
- Add the missing headers in your server config, .htaccess, Nginx config or CDN, then scan again.
How to view HTTP response headers yourself
In Chrome, Edge or Firefox, press F12 to open the developer tools, select the Network tab and reload the page. Click the first request and open Headers to see the response headers. From a terminal, run curl -I https://example.com.
How to add security headers
Apache (.htaccess)
<IfModule mod_headers.c>
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set X-Content-Type-Options "nosniff"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
</IfModule>Nginx (server block)
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;Add Content-Security-Policy last. Start with Content-Security-Policy-Report-Only, review what it would block, then switch to the enforcing header. If you use a CDN such as Cloudflare, you can set response headers there instead of on the server.
What your grade means
A higher grade means more of the recommended headers are set correctly, so browsers have stronger instructions for protecting your visitors. It measures browser-side hardening only. It doesn't replace keeping software patched, strong passwords, backups or a valid SSL certificate.
Next: run an SSL test
HSTS only works with a valid certificate. Check your SSL certificate, expiry date and TLS version.
Security Headers Checker FAQ
What is a security headers check?
It's a scan of the HTTP response headers a website sends, to see which security headers are set and which are missing.
What are HTTP response headers?
They're instructions a server sends with every page, before the content. Some control caching or content type; security headers tell the browser how to protect visitors.
Which security headers should every website have?
At minimum: Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options (or a CSP frame-ancestors rule), Referrer-Policy and, once tested, Content-Security-Policy.
Will a Content-Security-Policy break my site?
It can if it's too strict. Start with Content-Security-Policy-Report-Only, review the reports, then enforce.
Why did I lose points for the Server header?
Version details such as Apache/2.4.41 help attackers pick exploits. Hide them where possible.
How do I add security headers in WordPress?
Set them in your server configuration (.htaccess on Apache or the Nginx config), at your CDN, or with a security plugin that adds headers. Server or CDN level is the most reliable.
Is an A grade the same as a secure website?
No. It means good browser-side hardening. It doesn't replace patching, strong passwords and backups.
More free security tools
SSL/TLS Checker
Certificate expiry, trust status, protocol and cipher.
Open tool →DNS Lookup
A, AAAA, MX, NS, TXT, CNAME, SOA and CAA records.
Open tool →Email Security Checker
Check SPF, DKIM and DMARC for any domain.
Open tool →Suspicious URL Checker
Spot phishing signs in a link before you click it.
Open tool →IP Lookup
Location, ISP, ASN and reverse DNS for any IPv4 or IPv6 address.
Open tool →VPN & Proxy Checker
Find out if an IP belongs to a VPN, proxy or data center.
Open tool →