What is a security headers checker?
A security headers checker fetches a website over HTTPS and inspects the HTTP response headers that tell the browser how to protect visitors. It grades the result from A to F with a 0 to 100 score, then lists which protective headers are present, which are missing, and how to fix each gap. Getting these headers right is one of the cheapest, highest-impact things you can do to harden a site against cross-site scripting, clickjacking and protocol downgrade attacks.
How to grade your security headers
- Type a full URL or bare hostname (for example github.com) into the box above.
- Select Check. The grade appears in a few seconds.
- Read the A-F grade and score, then the present and missing header lists.
- Add any missing headers to your server or CDN using the plain-English guidance for each one.
What each security header does
- Strict-Transport-Security (HSTS): forces browsers to use HTTPS for every future request, so an attacker cannot silently downgrade a visitor to plain HTTP. Set a long max-age and consider includeSubDomains and preload.
- Content-Security-Policy (CSP): whitelists exactly which scripts, styles and other resources may load, which is the single strongest defense against cross-site scripting and content injection.
- X-Content-Type-Options: set to nosniff, it stops the browser from guessing (MIME-sniffing) a response's type, which can turn an uploaded file into executable script.
- X-Frame-Options: set to DENY or SAMEORIGIN (or CSP frame-ancestors), it stops other sites from framing yours and tricking users into clicks, known as clickjacking.
- Referrer-Policy: controls how much of the current URL is sent as the referrer when a user follows a link, so you do not leak paths or query strings to third parties.
- Permissions-Policy: restricts powerful browser features such as camera, microphone, geolocation and payment, so an injected script or embedded frame cannot silently use them.
Why security headers matter
Security headers are instructions the server sends with every response, and the browser enforces them for free. A missing HSTS header leaves visitors open to a downgrade on untrusted networks, a missing Content-Security-Policy makes any injected script far more dangerous, and a missing X-Frame-Options invites clickjacking. Because they are set once at the server or CDN and apply to the whole site, fixing the gaps this tool finds usually takes minutes and measurably reduces your attack surface.
Watch for information-leak headers
Some headers help attackers rather than users. A detailed Server banner or an X-Powered-By header tells the world exactly which software and version you run, which makes it trivial to look up matching exploits. This checker flags those information-leak headers so you can strip or generalize them.