Security Headers
Grade a site's HTTP security headers (CSP, HSTS and more).
No results yet
Enter a host above and press Run to start the check.
About the Security Headers
The Security Headers tool fetches a site's HTTP response headers and grades its security posture from A to F based on the presence and quality of headers like Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, and X-Content-Type-Options. It explains which protections are missing and why they matter, turning a complex audit into a clear letter grade. Use it to harden your site against clickjacking, XSS, and protocol downgrade attacks.
How to use
- Enter the URL of the site you want to grade.
- Click Scan to fetch and analyze the response headers.
- Review the overall A-to-F grade and per-header findings.
- Add the recommended missing headers to improve your score.
Which headers actually change your risk, in order
Not all of these carry equal weight, and a grading tool that treats them as a checklist obscures that. Content-Security-Policy is the only one on the list that can stop cross-site scripting, and it is also the only one that takes real work to deploy. HSTS closes the window where a first, unencrypted request can be intercepted. The rest — nosniff, X-Frame-Options, Referrer-Policy, Permissions-Policy — are each one line of config that removes one specific class of problem.
A CSP's presence tells you much less than its contents. `script-src 'unsafe-inline'` permits exactly the inline script injection that CSP exists to prevent, which makes such a policy close to decorative. In our scan of the top 10,000 domains, roughly a third of the enforced policies we found still allowed it. If you are retrofitting CSP onto an existing site, nonces or hashes are the path to removing that directive; expect it to be the bulk of the effort.
X-Frame-Options is superseded by CSP's `frame-ancestors`, which is more expressive — it accepts a list of permitted origins rather than a single all-or-nothing choice. Sending both is still reasonable for older clients, and where they disagree, browsers that support `frame-ancestors` use it and ignore the legacy header.
HSTS deserves care because it is difficult to undo. A browser that has seen `max-age=31536000` will refuse plain HTTP to your domain for a year, and adding `includeSubDomains` extends that to every subdomain — including any internal one still served over HTTP. Roll it out with a short max-age first, confirm nothing breaks, then raise it. Submitting to the preload list is effectively permanent.
Frequently asked questions
- Which headers affect the grade?
- Key headers include Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy. Missing or weak ones lower the score.
- What does Content-Security-Policy do?
- CSP restricts which sources of scripts, styles, and other content the browser may load, which is a strong defense against cross-site scripting (XSS).
- Why is HSTS important?
- Strict-Transport-Security forces browsers to use HTTPS, preventing downgrade attacks and cookie interception over insecure connections.