HTTP Security Headers Checker

About HTTP Headers

Fetches a URL the way a browser would — a GET, following redirects to the page a visitor actually lands on — and grades the security headers of that response from A+ to F. Every header is checked for correctness, not just presence: an HSTS max-age of a day, a Content-Security-Policy with 'unsafe-inline', an X-Frame-Options: ALLOW-FROM that no current browser honours, a Referrer-Policy that leaks full URLs.

The score is weighted by what each header protects against. A missing Content-Security-Policy or HSTS costs far more than a missing Cross-Origin-Resource-Policy, and a capped penalty for CSP weaknesses means a policy with small issues never scores below having none. The response is also read for the things scanners that only look for headers miss: a Server header naming its exact version, X-Powered-By advertising the framework, deprecated headers that now cause harm (X-XSS-Protection: 1, HPKP), a CORS configuration browsers will reject, and cookies set without Secure or with rules browsers enforce silently.

The result ends with the fix: the missing headers written for nginx, Apache, Caddy, Netlify or Cloudflare Pages, or Express — ready to paste, with a note on what to test first. Alongside it are the response details that explain slow or stale pages: status, redirects, response time, caching, compression and whether HTTP/3 is advertised.

Where it helps

• Grades correctness as well as presence: weak HSTS, unsafe CSP sources, obsolete framing options and leaky referrer policies are all caught.
• Flags version disclosure, deprecated headers that now do harm, impossible CORS combinations and cookie mistakes in the same pass.
• Writes the missing headers for six servers and platforms, so the fix is a paste rather than a research project.
• Uses GET and follows redirects with every hop checked, so the grade is for the page visitors actually get.

Limits

• The request carries no login, so pages behind authentication are graded on their redirect or error response.
• Headers can differ between pages, file types and CDN edges. The grade is for this URL; check the pages that matter most separately.
• The suggested Content-Security-Policy is a safe starting point, not a finished policy — roll it out as report-only and refine it with the CSP Generator.
• Public URLs only; private and loopback hosts are refused.

Frequently asked questions

Which security headers matter most?

HTTPS with Strict-Transport-Security, then a real Content-Security-Policy, then protection against framing (CSP frame-ancestors or X-Frame-Options) and X-Content-Type-Options: nosniff. Referrer-Policy and Permissions-Policy come next; the cross-origin isolation headers matter most for sites handling sensitive data.

Why is X-XSS-Protection marked as a problem?

Browsers have removed the XSS filter it switched on, and in the ones that kept it the filter could be abused to leak data from the page. The current advice is to send X-XSS-Protection: 0 or nothing, and rely on a Content-Security-Policy.

Will adding these headers break my site?

Most of them will not. The Content-Security-Policy can, because it blocks every script and style not explicitly allowed — send it as Content-Security-Policy-Report-Only first and watch the reports. Cross-Origin-Opener-Policy: same-origin can break OAuth and payment popups; use same-origin-allow-popups if the site relies on them.

Why does my grade differ from other scanners?

Scanners weigh headers differently, and this one also checks values, cookies, version disclosure and deprecated headers that others only count. Read the findings rather than the letter: each says what it costs and why.

Related tools

• CSP Generator — Build a Content-Security-Policy, or check one, and write it for your server or framework
• Cookie Parser and Builder — Read Set-Cookie and Cookie headers, check them against browser rules, and write one for your framework
• SSL Checker — Grade a TLS endpoint and inspect the certificate it serves
• Redirect Checker — Follow a URL's redirects hop by hop, and flag loops, downgrades and temporary redirects doing a permanent job
• DNS Lookup — Resolve A, AAAA, MX, TXT, NS, CNAME, SOA and CAA records
• IP Lookup — Resolve addresses and reverse DNS for a host or IP

More Network & DNS tools

• DNS Lookup — Resolve A, AAAA, MX, TXT, NS, CNAME, SOA and CAA records
• IP Lookup — Resolve addresses and reverse DNS for a host or IP
• Port Checker — Test whether TCP ports accept connections
• Nmap Port Scanner — Scan a host's common TCP ports, Nmap style, and see what each open service says it is
• Ping (TCP) — Measure connection latency with repeated TCP probes
• What Is My IP — Your public address, and what a browser reveals about you
• WHOIS — Registry records for a domain, an IP address or an AS number
• DNS Propagation Checker — The same name asked of resolvers worldwide, and of the zone's own servers
• Email Authentication Checker — SPF, DKIM, DMARC and MX for a domain, read together
• Email Header Analyzer — The delivery path, the authentication results, and what a forgery looks like
• DKIM Lookup — A domain's DKIM keys, for a selector or by trying the common ones, and whether each is worth anything
• DMARC Lookup — A domain's DMARC policy, and what it actually asks receivers to do
• Reverse DNS Lookup — The PTR record for an address, and whether it confirms itself
• IP Blacklist Checker — Whether an address is on the blocklists that actually stop mail
• Reverse IP Lookup — What an address says about itself: its name, its certificate, its network
• Traceroute — Every hop between this server and a host, with the time each one took
• Broadband Speed Test — Download, upload, latency and jitter, measured from this tab
• Redirect Checker — Follow a URL's redirects hop by hop, and flag loops, downgrades and temporary redirects doing a permanent job
• IP Address Converter — Write an IPv4 or IPv6 address as an integer, hex, binary, expanded or mapped form, and see what kind it is
• MAC Address Lookup — Find the manufacturer behind a MAC address, and see what kind of address it is
• MAC to IP Converter — Build the IPv6 address a MAC forms with SLAAC, recover the MAC from one, or find a MAC's IP in an ARP table
• IP to MAC Lookup — Find the MAC address behind an IP: computed for multicast and EUI-64 addresses, or read from an ARP table
• DNSSEC Checker — Whether a domain's DNSSEC validates, and if not, whether it is the DS, a key, an algorithm or an expired signature