Strict-Transport-Security
The high-severity check: without HSTS, a browser can be downgraded to plain HTTP. The recommended value is Strict-Transport-Security: max-age=31536000; includeSubDomains.
HTTP security headers
Check HTTP security headers and get an A+ to F grade
Every analyzed response is graded on its security posture: HTTPS, HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, plus cookie Secure, HttpOnly, and SameSite flags. Each gap comes with the exact value to add.
Grade a site's security headers
Paste any public URL into the analyzer to read its raw source, run the SEO audit, grade its security headers, and detect the technologies it uses — free, with no signup and nothing stored.
Headers checked, and the value to add
Content-Security-Policy
Restricts which origins may supply scripts, styles, and frames, and is the strongest defence against injected script. Because a strict policy breaks pages easily, we suggest rolling it out in report-only mode first.
X-Content-Type-Options
Stops browsers from MIME-sniffing a response into a different type than the server declared. The fix is a single line: X-Content-Type-Options: nosniff.
X-Frame-Options
Prevents clickjacking by controlling whether the page may be framed. Add X-Frame-Options: SAMEORIGIN, or the equivalent Content-Security-Policy frame-ancestors directive.
Referrer-Policy
Controls how much referrer information leaves with outbound requests. The practical default is Referrer-Policy: strict-origin-when-cross-origin.
Permissions-Policy and COOP
Permissions-Policy limits access to geolocation, camera, and microphone; Cross-Origin-Opener-Policy: same-origin isolates the browsing context from cross-origin documents. Both are graded, with the recommendation shown when absent.
Cookies, leaks, and findings
Cookie security flags
Every Set-Cookie header is parsed for Secure, HttpOnly, SameSite, and Max-Age or Expires, and for the __Host- and __Secure- name prefixes. A cookie missing Secure or HttpOnly is reported by name.
Server version leakage
Server, X-Powered-By, X-ASP.NET-Version, and X-Generator are inspected. When they expose a version, the report lists exactly which headers gave it away, since that advertisement helps an attacker pick an exploit.
A prioritised findings list
Missing headers, plain-HTTP delivery, and unmarked cookies are collected into a single findings list — up to 40 entries — so the fixes can be worked through in one pass instead of hunting through tabs.
Every header, with its raw value
The security panel shows all graded headers as a table with present or absent status and the value actually received, so you can paste it straight into a config diff or a ticket.
How the grade is calculated
Eight graded signals
The score covers HTTPS itself plus seven response headers: HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, and Cross-Origin-Opener-Policy. Each present header earns its share.
A + to F letters
The percentage of signals present maps to a letter grade: A+ at 95 or above, A at 85, B at 75, C at 65, D at 50, and F below that — so an F usually means several headers are missing at once.
Severity on every check
Headers are tagged high, medium, or low severity, which keeps the grading honest: a missing CSP is not treated as equal to a missing Referrer-Policy, and the findings list follows that order.
FAQ
HTTP security headers FAQs
The questions people ask most about this tool — and the limits worth knowing before you rely on it.
What grade should a site aim for?
A or A+. Reaching A+ means HTTPS plus every graded header present: HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, and Cross-Origin-Opener-Policy. Most sites can get to A by adding nosniff, SAMEORIGIN, and a referrer policy.
Does a bad grade mean the site is hacked?
No. The grade measures hardening, not compromise. A missing header is an opportunity an attacker could use, not evidence that anything happened. The findings list frames each gap as a fix to apply.
Why is a cookie reported when the site works fine?
A cookie without Secure can be sent over plain HTTP, and one without HttpOnly is readable by JavaScript — which matters if an injected script ever runs. Marking session cookies with Secure, HttpOnly, and SameSite is a one-line change per cookie.
Can I check headers for a site I do not own?
Yes, and it is a normal part of competitive and vendor review. The response headers are public: any browser receives them. Only analyze pages you are permitted to access, and change headers only on systems you control.
Where is the exact value to add shown?
In the Security tab of the result. Each header is listed with its status, its current value, its severity, and a recommendation naming the value to set — for example X-Content-Type-Options: nosniff.
Related tools