Security Headers Analyzer - Grade Your HTTP Security Headers (A+ to F)
Security Headers Analyzer
Check the security headers your site sends and get a grade with advice
A Grade and the Reasons
Get a score out of 100 and a letter grade, with every header explained in plain language and marked good, warning or missing.
CSP Checked in Detail
The Content-Security-Policy is parsed to spot unsafe-inline, unsafe-eval, wildcard script sources and missing directives.
URL or Pasted Headers
Fetch a public site's headers, or paste headers from curl, your server or a proxy to test a site that is not public yet.
Safe Lookups
Address lookups are made by this site's server with protections that block private and internal addresses.
Why These Headers Matter
Security headers are instructions your server sends to browsers that switch on built-in protections. HSTS forces HTTPS, a Content-Security-Policy limits where scripts can load from and blocks many injection attacks, X-Content-Type-Options stops browsers guessing file types, and frame-ancestors or X-Frame-Options stop your pages being framed by other sites. Referrer-Policy and Permissions-Policy limit what leaks to other sites and what powerful features a page may use.
The grade is a guide, not an audit. It scores which headers are present and how strong they look, in the spirit of well-known online scanners, but a perfect grade does not mean a site is secure, and a site with a lower grade may be fine for its purpose. The tool sees only what your server sends to this check, which uses a HEAD request, so headers that appear only on other pages or methods, or several Set-Cookie lines, may not show. Paste real headers for a fuller picture.
Key Takeaways
- Suggestions: Missing headers come with a starting-point value you can copy.
- HTTPS aware: HSTS is only scored when the page was fetched over HTTPS.
- Related tools: See also the CSP Header Generator and the HTTP Headers Viewer.