What it does
Security headers tell the browser how to treat your pages: always use HTTPS, which scripts may run, whether other sites may frame them. They cost nothing to add and close off attacks such as clickjacking and some script injection.
This checker follows any redirects, reads the headers on the final response and grades them from A to F, with a finding for each one.
How to use it
- 1Enter a domain or page in Website or page URL and press Grade the headers.
- 2Look at the grade and the count of things to look at.
- 3Work through the findings. Fix items matter most; Check items are weak values or missing optional headers.
- 4Open All response headers to see the raw values, change your server or CDN settings, and check again.
The headers that are checked
It also confirms the page ends on HTTPS and looks for software versions in the Server or X-Powered-By headers.
- Strict-Transport-Security: HTTPS only. One year (31536000) is common; the check wants at least six months.
- Content-Security-Policy: where scripts and other resources may load from. 'unsafe-inline' scripts without nonces or 'strict-dynamic' weaken it.
- X-Content-Type-Options: nosniff stops browsers guessing a file's type.
- Clickjacking: CSP frame-ancestors or X-Frame-Options controls who may frame the page.
- Referrer-Policy: how much of the URL other sites receive. unsafe-url is flagged.
- Permissions-Policy: turns off features the page doesn't use, such as camera or geolocation.
How the grade is worked out
Eight checks each score 2 for a pass, 1 for a warning and 0 for a fail. 93% of the maximum is an A, 80% a B, 65% a C, 50% a D, below that an F. In practice an A allows one warning and no fails.
It's a read of headers, not a security audit. Roll out a CSP as Content-Security-Policy-Report-Only first so it can't break scripts you rely on; the checker counts report-only as missing because it blocks nothing yet.
Questions
Where do I add security headers?
In your web server config (nginx, Apache, Caddy), your CDN or hosting dashboard, or your framework's headers setting. Set them for all responses.
Is X-Frame-Options still needed?
CSP frame-ancestors does the same job in current browsers, and this check accepts either. Sending X-Frame-Options as well does no harm.
Do security headers affect SEO?
Not directly. HTTPS is a small ranking signal for Google, and the other headers help indirectly by keeping the site safe.
Why don't I get an A with every header set?
Weak values count as warnings: HSTS under six months, a CSP allowing inline scripts, unsafe-url, or a version number in Server. Two warnings mean a B.
Should I add includeSubDomains to HSTS?
Only once every subdomain works over HTTPS. Browsers remember HSTS for as long as max-age says and will refuse plain HTTP until then.