Security headers checker
Security headers are instructions a website sends to the browser to switch on built-in protection: always use HTTPS, do not run injected scripts, do not be embedded in other sites. They are one of the cheapest ways to harden a site.
This tool loads the address, reads the headers and gives a grade from A to F, with a short explanation for each header and what to do if it is missing.
How to read the results
- Strict-Transport-Security makes browsers use HTTPS only.
- Content-Security-Policy limits where scripts and other content can load from. It is the strongest and the hardest to set up.
- X-Frame-Options stops other sites embedding the page, which prevents clickjacking.
- X-Content-Type-Options stops browsers guessing file types.
- Referrer-Policy and Permissions-Policy limit what information and browser features the page shares.
Questions
Is a low grade a sign the site is hacked?
No. It only means the extra protections are not switched on. Many ordinary sites score low, and the headers can usually be added in the server or CDN settings.
How is the grade worked out?
Each header is worth a number of points, with the Content-Security-Policy and HSTS counting the most. Missing headers score nothing and weak settings score half.
Will adding these headers break my site?
A strict Content-Security-Policy can block scripts you rely on, so test it first. The others are low risk.
Related guides
More free tools
- DNS lookup
- HTTP header checker
- SSL certificate checker
- Redirect checker
- WHOIS and domain expiry
- MX record lookup
- Robots.txt checker
Results are a snapshot taken from our servers at the moment you ask, and can differ from what you see elsewhere. siteupdown.com tests public websites only. Spotted a problem?