Free website tool
HTTP Headers and Security Headers Checker
See every HTTP response header a URL returns and get a security grade for HSTS, CSP, X-Frame-Options and more, with fixes.
What the checker does
We request the URL from our server, follow redirects to the final page and list every response header it returns, exactly as sent. Security headers are highlighted, graded and explained, with the value to use when one is missing.
The headers that matter most
- Strict-Transport-Security: makes browsers use HTTPS for your domain, even if someone types http://.
- Content-Security-Policy: limits where scripts, styles and frames can load from, the main defense against cross-site scripting.
- X-Frame-Options / frame-ancestors: stops other sites embedding yours in a frame to trick clicks.
- X-Content-Type-Options: nosniff: stops browsers treating an uploaded file as a script.
- Referrer-Policy and Permissions-Policy: limit what other sites learn about your visitors and which browser features pages may use.
We also flag headers that leak software versions, deprecated headers and cookies without Secure, HttpOnly or SameSite.
Frequently asked questions
- How is the security grade calculated?
- Six headers earn points: Strict-Transport-Security (25), Content-Security-Policy (25), clickjacking protection via X-Frame-Options or CSP frame-ancestors (15), X-Content-Type-Options (15), Referrer-Policy (10) and Permissions-Policy (10). Weak values earn partial credit. A+ needs all six with strong values. Pages served over plain HTTP are capped at D, because headers sent without encryption can be altered in transit.
- Do security headers help SEO?
- Not directly; Google doesn't rank pages by their headers. HSTS does help indirectly by keeping visitors and crawlers on HTTPS. Headers such as X-Robots-Tag, Cache-Control, Content-Type and Link (for canonicals on PDFs) do affect how search engines crawl and index a URL, and they're all listed here.
- How do I add security headers to my site?
- Where depends on your stack: in nginx with add_header, in Apache or LiteSpeed with Header set in .htaccess, in a CDN like Cloudflare with response header rules, or in the framework's config (for example headers() in Next.js). Add HSTS only once the whole site and its subdomains work over HTTPS, and roll out CSP in report-only mode first.