Security Headers Checker
Check whether a website sends the HTTP security headers browsers rely on — HSTS, Content-Security-Policy, X-Frame-Options and more — and get a grade from A+ to F.
How it works
How the grade is calculated
Six checks
Each header that is present and sound earns a full point, a weak value earns half. Six points give A+, five A, four B and so on down to F.
The final response counts
Redirects are followed and the headers of the final page are graded, because that is the page your visitors load.
Add them at the edge
If you cannot change the application, a CDN can add security headers to every response for you.
FAQ
Frequently asked questions
Is a Content-Security-Policy hard to add?
Start with Content-Security-Policy-Report-Only to collect violations without blocking anything, then switch to the enforcing header once the reports are clean.
Does HSTS affect subdomains?
Only with includeSubDomains. Add it once every subdomain works over HTTPS, and consider the preload list after that.
Why is X-XSS-Protection not checked?
Modern browsers have removed the XSS auditor that header controlled. A Content-Security-Policy is the replacement.
More free tools
All toolsWAF, bot defence and rate limits