HTTP header & security check
See every response header a site sends, and get a graded report on the six headers that actually protect your visitors.
The headers we grade
- Content-Security-Policy (25 points) — the single most effective defence against cross-site scripting. It tells the browser which sources of script, style and media are allowed.
- Strict-Transport-Security (20) — once seen, the browser refuses to use plain HTTP for your domain, which closes the downgrade window on public Wi-Fi.
- X-Content-Type-Options: nosniff (15) — stops the browser second-guessing content types and executing an upload as script.
- X-Frame-Options (15) — blocks clickjacking by refusing to be embedded in someone else's frame.
- Referrer-Policy (15) — controls how much of the current URL is handed to the next site. Matters if your URLs carry tokens or identifiers.
- Permissions-Policy (10) — switches off camera, microphone, geolocation and other features you do not use.
Headers that give too much away
We also flag headers that advertise your stack — Server, X-Powered-By, X-Generator. Publishing your exact PHP or framework version is free reconnaissance for anyone scanning for a known vulnerability. Removing them takes one line of config.
How to fix a low grade
Add the three cheap headers first — nosniff, X-Frame-Options and a sensible Referrer-Policy. They almost never break anything. Save Content-Security-Policy for last: deploy it in report-only mode, watch what it would have blocked, and tighten from there.
FAQ
Will adding these headers break my site?
Only Content-Security-Policy realistically can, because it restricts what may load. Test it in report-only mode first. The other five are safe on almost every site.
Where do I set them?
In your web server: an .htaccess or vhost block for Apache, a server block for nginx, or the CDN edge if you use one. Setting them in application code works too but is easy to miss on error pages.
Does a good grade mean my site is secure?
No. It means the browser-side defences are configured. Application security, patching and access control are separate work.
Related reading
Other tools
Website status checker
Is it up, how fast, and what is it running?
Ping test
Round-trip latency and packet loss.
DNS lookup
A, AAAA, MX, NS, TXT, SOA and CAA records.
SSL certificate checker
Expiry, issuer, chain and hostname match.
Open port checker
Which TCP ports answer from the outside.
WHOIS lookup
Registrar, age, expiry and nameservers.
Want this checked automatically?
Free monitoring every 5 minutes with email alerts when something breaks.