Free Security Tool

HTTP Security Header Checker

Grade any site's HTTP security headers from A to F in seconds.

Get the full picture for your domain

Free recon check of your external footprint: headers, TLS, DNS, subdomains and CVE signals. Your report and a PDF summary, sent to your work email on that domain.

Free External Security Check

What HTTP security headers are and why they matter

Security headers are directives your server sends with every response to tell the browser how to handle your site. They are the cheapest defence against cross-site scripting (XSS), clickjacking, MIME sniffing and protocol downgrade attacks, and a missing header is one of the most common, easiest fixes on the web.

Which security headers this checker tests

  • Strict-Transport-Security (HSTS): forces HTTPS and blocks downgrade attacks.
  • Content-Security-Policy (CSP): controls which scripts and resources may load, the strongest browser-side defence against XSS.
  • X-Content-Type-Options: stops MIME sniffing.
  • X-Frame-Options: prevents framing, which defeats clickjacking.
  • Referrer-Policy and Permissions-Policy: limit referrer leakage and browser features such as camera and geolocation.

How to add security headers to your website

Set them in your web server or framework config. Start with HSTS and a report-only Content-Security-Policy, then tighten the policy once you confirm nothing legitimate is blocked. For copy-ready snippets, read how to check your website's security headers.

Frequently asked questions

What security headers should every website have?

Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy. Together they defend against XSS, clickjacking, MIME sniffing and downgrade attacks.

How do I check my HTTP security headers?

Enter your URL above. The tool reads the response headers and grades them from A to F with a fix for each gap. You can also inspect them in your browser developer tools under the Network tab.

How do I add security headers to my website?

Set them at the web server or framework level: add_header in Nginx, Header set in Apache, middleware in Next.js, or the helmet package in Express.

What is Content-Security-Policy?

An HTTP header that controls which resources (scripts, styles, images) a browser may load on your page. It is the most effective browser-side defence against XSS.

What is HSTS?

HTTP Strict-Transport-Security tells browsers to only ever connect to your site over HTTPS. It prevents downgrade attacks and stops a first insecure request from being intercepted.