Security Headers Checker: Free Online Grade

This security headers checker reads the HTTP response headers of any public website and grades them. Enter a URL and you get an overall security grade, the percentage of weighted headers implemented, and a Good, Needs improvement or Missing status for each header, along with the recommended value to add. It is free and needs no sign-in.

What Are HTTP Security Headers?

HTTP security headers are instructions a web server sends with every page so the visitor's browser switches on built-in protections. They do not change how your page looks. They tell the browser what it may load, whether the page can be framed, and how strictly to enforce HTTPS.

Each header targets a specific risk. Content-Security-Policy limits where scripts and other resources can come from, which reduces the damage of cross-site scripting. Strict-Transport-Security tells browsers to use HTTPS only. X-Frame-Options helps stop clickjacking. X-Content-Type-Options stops browsers from guessing file types.

Security scanners often report a missing header under CWE-693 (Protection Mechanism Failure). That is a weakness category, not a confirmed attack. It means a defense the browser offers is not turned on. Tools such as Helmet for Express apps exist to set several of these headers in one step, but you can also add them in your web server or CDN settings.

How to Use the Security Headers Checker

1. Type or paste the address into the Website URL field, for example https://example.com. If you leave off the protocol, the checker adds https:// for you.
2. Click Check Security Headers. The button changes to Checking... while the request runs.
3. Read the Security Grade at the top, from A+ down to F, and the line showing the percentage of weighted security headers implemented.
4. Scroll through the header cards. Each one shows a severity chip (High, Medium or Low), a status, and a short description of what the header does.
5. For a header that is present, compare the value shown with the recommended value. For a missing header, copy the recommended value shown on its card.
6. Add or fix the headers in your server or CDN configuration, then run the check again to confirm the grade improved.

The checker follows up to five redirects and reports the headers from the final page. If your site redirects http to https, or non-www to www, you are grading the page visitors actually land on.

Example: Reading a Real Result

Suppose you check a small business site and the final page returns four of the headers you expect. Here is what the report would show and what it means.

• Strict-Transport-Security: max-age=31536000; includeSubDomains. Status Good. That value is one year in seconds, the common baseline.
• X-Content-Type-Options: nosniff. Status Good.
• X-Frame-Options: SAMEORIGIN. Status Good.
• Content-Security-Policy: not sent. Status Missing, severity High, with default-src 'self' shown as the starting recommendation.
• Referrer-Policy and Permissions-Policy: not sent. Status Missing, severity Low.

Even with three headers in place, the grade will not be top tier, because the missing Content-Security-Policy is a high-severity item and counts for more than a low-severity one. The fastest gain is to add a Content-Security-Policy, then the two low-severity headers. Rechecking after each change shows exactly how much each one moved the percentage.

How to Read Your Security Grade and Results

The grade summarizes how many of the weighted headers you have implemented, and the status on each card tells you what to fix. Green A grades mean most important headers are in place. Amber, orange and red grades (C, D, F) mean high or medium severity headers are missing or weak.

The three statuses

• Good: the header is present with a sensible value. Leave it alone.
• Needs improvement: the header exists but the value is weak or incomplete, such as a very short HSTS lifetime. Compare it with the recommended value.
• Missing: the server did not send the header. Add it using the recommended value shown.

X-XSS-Protection is shown as informational and is not graded. It is a deprecated legacy filter. The recommendation is to set it to 0 or omit it and rely on Content-Security-Policy instead.

What each severity covers

How Do You Check Security Headers in Chrome?

You can inspect headers manually in Chrome by opening DevTools, going to the Network tab, reloading the page and clicking the first request. Under Response Headers you will see every header the server sent, including Strict-Transport-Security if it is set.

That works well for one page, but you have to read each header and judge the value yourself. The checker does the lookup from a clean request and tells you which headers are missing or weak, so it is quicker for audits and for before-and-after comparisons.

Who Should Use This Security Headers Test?

Anyone responsible for a public website can use it to spot missing protections in under a minute. Typical situations include these.

• Site owners and developers confirming a new deploy sends the headers they configured.
• SEO specialists running a technical audit, since a site that triggers browser security warnings can lose visitor trust. Headers are not a direct ranking factor, but HTTPS is a lightweight Google signal and HSTS keeps visitors on it.
• Agencies checking a client's site before a security review or a penetration test, where missing headers are among the first findings.
• Teams behind a CDN or proxy verifying that the edge layer is not stripping or overriding headers set at the origin.

If you are also reviewing the wider security setup, you can pair this check with a certificate decoder for SSL details or a domain blacklist checker to see whether your domain is listed on email blocklists.

Best Practices, Common Mistakes and Troubleshooting

Add headers gradually, test after each change and match the value to how your site actually works. A header that is too strict can break pages, so changes deserve a quick check in a browser.

Start Content-Security-Policy carefully

The recommended default-src 'self' allows resources only from your own domain. If your site loads analytics, fonts, embeds or a chat widget from other domains, a policy this strict will block them. Build a policy that lists the sources you really use. A Content Security Policy generator can produce the header plus Apache, Nginx and meta tag versions.

Common mistakes

• Setting headers on the wrong layer. If a CDN or load balancer sits in front of your server, add the headers there or make sure they pass through.
• Using a very short HSTS lifetime. A tiny max-age gives little protection. One year, 31536000 seconds, is the common baseline. Make sure all subdomains support HTTPS before adding includeSubDomains.
• Setting headers only on the home page. The checker reads the URL you enter. Rules in your config may apply to some paths and not others, so test a key inner page too.
• Relying on X-XSS-Protection. It is deprecated. A Content-Security-Policy is the modern replacement.
• Forgetting to reload the server. After editing Apache or Nginx configuration, reload the service, then clear any CDN cache before rechecking.

If the result looks wrong

If the checker says a header is missing but you just added it, a cache is the usual cause. Purge the CDN or page cache and run the check again. If you see an error about the URL, confirm the address is spelled correctly and publicly reachable. Pages behind a login, private networks and local addresses cannot be checked. Also remember that email headers are a different topic. For those, use an email header analyzer instead.

Limitations to Keep in Mind

The checker grades which response headers a page sends and whether their values look sensible. It is not a full vulnerability scan. It does not test your code, plugins, forms or server software, and a top grade does not prove a site is secure.

It also looks at one URL at a time and reports the final page after redirects. Headers can differ between pages, subdomains and file types. Content-Security-Policy in particular needs human judgment, because the tool can tell you a policy exists but not whether it fits your site's scripts. Treat the grade as a snapshot and recheck after every server, CDN or hosting change.

Run the checker above on your own site now, fix the high-severity items first, and rerun it to see your grade climb. For more utilities in this area, browse the full security and encryption tools collection.