Security Headers Checker
Grade your HTTP security headers — CSP, HSTS, X-Frame-Options, and more.
About Security Headers
Grades a site's HTTP security headers — Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and others — against current best practice, and reports what's present, missing, or misconfigured. Missing security headers are one of the most common, easily-fixed findings in a basic security audit. The grade breaks down by header rather than giving one opaque score, since each header serves a distinct purpose — HSTS prevents protocol downgrade, X-Frame-Options prevents clickjacking, CSP restricts what a page can load.
A high score here is defense-in-depth, not a substitute for fixing the underlying vulnerabilities these headers guard against — CSP and X-Frame-Options reduce the blast radius of an XSS or clickjacking bug, they don't prevent the bug from existing in application code.