Free Security Headers Checker
Instantly grade any website's HTTP security headers. The checker inspects HSTS, Content-Security-Policy, X-Frame-Options, and more, then scores your configuration A+ to F and flags headers that leak stack details. No signup, no install — results in seconds.
Which security headers this tool checks
The checker evaluates the headers that browsers act on to harden a page. Strict-Transport-Security (HSTS) forces every future request over HTTPS and prevents SSL-stripping downgrade attacks. Content-Security-Policy (CSP) is the single most impactful header for mitigating cross-site scripting: a well-built policy allowlists the exact script sources you trust and blocks everything else, so an injected <script> tag simply won't execute.
X-Frame-Options (or the modern frame-ancestors CSP directive) stops your pages from being embedded in a hostile iframe, defeating clickjacking. X-Content-Type-Options: nosniff prevents the browser from second-guessing declared content types, a common vector for turning an uploaded file into executable script. Referrer-Policy controls how much URL data leaks to third parties, and Permissions-Policy locks down powerful browser features like camera, microphone, and geolocation.
How to fix missing security headers
Most missing headers are added at the edge — your reverse proxy, CDN, or framework config — rather than in application code. On Nginx you set them with add_header directives; on a Next.js app you add them to the headers() function in next.config.js; on Vercel or Netlify you configure them in the platform's headers file. Start with HSTS and a Content-Security-Policy, since those carry the most weight.
Building a Content-Security-Policy is the hardest step because a too-strict policy can break legitimate scripts. The safe path is to deploy it first in Content-Security-Policy-Report-Only mode, collect violation reports, refine the allowlist until your own assets stop tripping it, and only then switch to the enforcing header. Prefer a nonce- or hash-based policy over 'unsafe-inline' so inline scripts you control still run while injected ones don't.
Frequently asked questions
- What are HTTP security headers?
- HTTP security headers are response headers a server sends to instruct the browser how to behave more securely. Key ones include Strict-Transport-Security (forces HTTPS), Content-Security-Policy (blocks injected scripts and mitigates XSS), X-Frame-Options (prevents clickjacking), X-Content-Type-Options (stops MIME sniffing), Referrer-Policy, and Permissions-Policy. Missing headers don't always mean a vulnerability, but they remove defense-in-depth protections the browser could otherwise enforce.
- How does this security headers checker work?
- Enter a URL and the tool fetches the page server-side, reads the response headers, and grades them. It reports which security headers are present or missing, assigns an A+ to F score weighted by severity, and flags information-disclosure headers like Server and X-Powered-By that reveal your stack. It's a passive check — no payloads are sent to your site.
- What is a good security headers score?
- Aim for A or A+. That typically means HTTPS is enforced with HSTS, a Content-Security-Policy is set, X-Frame-Options or a frame-ancestors CSP directive is present, X-Content-Type-Options is nosniff, and a Referrer-Policy and Permissions-Policy are defined. A failing grade usually indicates several of these are absent.
- Do security headers prevent all attacks?
- No. Headers are one layer of defense. A strict CSP makes XSS much harder to exploit, but it does not fix the underlying injection flaw. Headers do nothing for SQL injection, broken authentication, insecure direct object references, or business-logic bugs. Use this tool for the header layer, then run a full Vuln0x scan for injection, auth, and misconfiguration testing.
- Why does the Server or X-Powered-By header matter?
- Those headers reveal the exact software and version running your site, which helps attackers match known CVEs to your stack. Removing or genericizing them is a low-effort hardening step. The checker highlights them under 'information disclosure' when present.
Go beyond a single check
This tool covers one surface. Vuln0x runs 40+ scanners — headers, TLS, injection, auth, and more — and grades your site in under 60 seconds. Free, no credit card.