Free Security & tech tool
Security Headers Checker
Grade the HTTP security headers of any site, and copy ready-made config for the ones it’s missing.
- Free
- No sign-up
- Results in seconds
Full audit
This is one part of the full report
Speed, Core Web Vitals, UX, SEO and security in one free report, graded A+ to F, with AI fixes for your platform.
What it checks
Strict-Transport-Security
Forces HTTPS on every visit and blocks downgrade attacks.
Content-Security-Policy
Controls where scripts load from, with a review of unsafe-inline, eval and wildcards.
Clickjacking protection
X-Frame-Options or frame-ancestors stop other sites framing yours.
Referrer, MIME and permissions
Referrer-Policy, X-Content-Type-Options and Permissions-Policy.
Cookie flags
Secure, HttpOnly and SameSite on every cookie the page sets.
HTTPS redirect
Whether plain http:// sends visitors to the secure site.
Questions
What are HTTP security headers?
Instructions your server sends with every page. They tell the browser to always use HTTPS, which scripts may run, and whether other sites may frame yours. They cost nothing and block whole classes of attacks.
How is the grade worked out?
HSTS and Content-Security-Policy count most, 25% each. X-Content-Type-Options and clickjacking protection count 15% each, and Referrer-Policy and Permissions-Policy 10% each. It’s the same grade as the security section of the full report.
Will a Content-Security-Policy break my site?
It can, if the policy blocks a script you use. That’s why the snippet we give you is report-only: browsers log what they would block but block nothing. Once the console is clean, rename the header to Content-Security-Policy.
Where do I add these headers?
In your web server or hosting config. Pick your platform above the snippet: Nginx, Apache, Cloudflare and Netlify (_headers file), Vercel (vercel.json) or Next.js (next.config.js). On WordPress, a headers plugin can add them too.