Security Headers Checker
Check any website’s security headers — get a letter score, plain-English explanations of every finding, and copy-ready fixes for your stack.
Security headers are the cheap, high-impact layer of web defence: they tell browsers how to protect visitors from XSS, clickjacking, MIME-sniffing, SSL-stripping and referrer leaks. This checker scores all six that matter — Content-Security-Policy, Strict-Transport-Security (HSTS), X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy — explains each result in plain English, flags the specific values that are weak (a 1-day HSTS window, a CSP full of ’unsafe-inline’), and generates fix snippets for nginx, Apache, Django or Express.
Check a site
Capture with curl -sI https://your-site.com, or in DevTools: F12 → Network tab → click your site name → right-click the first request → Copy → Copy response headers. If there are redirects, paste everything and the checker analyzes the final response.
Score
Findings
Recommended response headers
The target state for a strong site. Send these on every response (including error pages — in nginx that means the always flag).
Fix snippets for your stack
Lines marked # MISSING or # WEAK are the ones your current headers need; the rest are the recommended baseline.
Export report
That’s a browser security rule (CORS), not a problem with the site — and it’s why every serious headers checker needs the raw response. Capture them in about ten seconds:
What each header does (and what breaks without it)
Strict-Transport-Security (HSTS) — 20 points
Tells browsers to only ever talk to this site over HTTPS for the stated period. It stops SSL-stripping and downgrade attacks on repeat visits: without it, an attacker on your network can intercept the first plain-HTTP request and redirect you to a convincing fake of your site. A full year (max-age=31536000) with includeSubDomains is the recommended baseline; the preload flag lets browsers ship your domain in their built-in HSTS list so even the very first visit is HTTPS-only.
Content-Security-Policy (CSP) — 30 points
A whitelist of where the browser may load scripts, styles, images and frames from. If an attacker manages to inject code into your pages, CSP is what stops that code running or phoning home — it is the single strongest defence against XSS and data-injection attacks. The weak forms (’unsafe-inline’, ’unsafe-eval’, wildcard *) let most injected scripts through anyway, which is why the checker scores them down.
X-Frame-Options — 15 points
Controls whether your page can be placed inside an <iframe>. Without it, an attacker can overlay your login form on top of a fake page in an invisible frame and harvest the click — that’s clickjacking. DENY (never framed) is right for login pages; SAMEORIGIN is the usual choice. CSP frame-ancestors is the modern replacement with per-origin control.
X-Content-Type-Options — 15 points
The value nosniff tells browsers to use exactly the Content-Type your server declared, instead of guessing (MIME-sniffing). Without it, a file you served as text/plain can be executed by an old browser as JavaScript — a classic XSS vector that still shows up in penetration tests.
Referrer-Policy — 10 points
Decides how much of your URL gets sent in the Referer header when a visitor clicks out to another site. Query strings routinely carry tokens, session IDs and personal data — without this header, the browser default forwards them to every third party you link to. strict-origin-when-cross-origin (full URL same-origin, bare origin cross-origin, nothing across a downgrade) is the recommended default.
Permissions-Policy — 10 points
A per-feature allowlist for powerful browser APIs: camera, microphone, geolocation, payment and friends. It stops an embedded third-party script or iframe from silently requesting your camera or location without the page owner’s consent — increasingly relevant as sites embed more third-party content.
Score scale
A+ / A everything set and strong B / C most headers present but some weak or missing D / F critical protections absent. Points: HSTS 20, CSP 30, X-Frame-Options 15, X-Content-Type-Options 15, Referrer-Policy 10, Permissions-Policy 10.
How to capture your site’s response headers
From a terminal (fastest):
curl -sI https://your-site.com
If the output contains several blocks (redirects), paste them all — the checker analyzes the final response and tells you which one it used. Add -L to follow redirects.
From your browser: open DevTools (F12) → Network tab → reload → click your site name in the request list → right-click the first request → Copy → Copy response headers. Paste into the box above.
Suggested
