Check all security headers for any website — HSTS, CSP, X-Frame-Options, Referrer-Policy, and more. Instant A–F grade with fix instructions.
Frequently asked questions
What are HTTP security headers?
HTTP security headers are response headers that instruct browsers how to handle your site securely. They prevent clickjacking (X-Frame-Options), cross-site scripting (Content-Security-Policy), protocol downgrade attacks (Strict-Transport-Security), MIME sniffing (X-Content-Type-Options), and referrer URL leakage (Referrer-Policy). Together they form a defense-in-depth layer that protects users even if application-level security fails.
Why does my site need HSTS?
Without HSTS, browsers connect over plain HTTP on the first visit or when a user types http:// explicitly. This enables SSL stripping attacks where an attacker on the same network intercepts the initial HTTP request before the server redirects to HTTPS. HSTS tells browsers to always use HTTPS for a specified duration (recommended: at least 1 year = 31536000 seconds).
What is Content-Security-Policy?
CSP restricts which resources (scripts, styles, images, fonts) a browser can load and execute. It's the most effective defense against XSS attacks because it blocks inline scripts and limits script execution to trusted sources. Without CSP, any injected JavaScript runs with full access to the page, cookies, and session tokens.
How do I fix missing security headers?
Add them at your web server level (nginx, Apache, Caddy) or CDN configuration (Cloudflare, Fastly). Each header has a recommended value shown in this tool's results. For example, nginx: add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; Cloudflare: enable HSTS in SSL/TLS settings and use Transform Rules for custom headers.