Knowledge Mark G
Hire Me

100% free website tool

Security Headers Checker

Grade a site's HTTP security headers, HTTPS redirect and TLS certificate - with the exact fix for each problem.

  • No sign-up required
  • Instant results
  • Only the address is sent
  • Works on any device

Check a site

We request the page once, read the response headers and open a TLS connection to inspect the certificate. Page content is not stored.

Enter an address to grade its HTTP security headers, HTTPS redirect and certificate.

Private by design. Only the web address you enter is sent - to fetch the page. Nothing is stored.

  • 100% freeNo hidden charges, no watermark
  • Instant resultsDone in seconds, no queue
  • Secure & privateOnly the address is sent
  • Works on all devicesDesktop, tablet and mobile

How to use the Security Headers Checker

  1. 1Enter a website address.
  2. 2Get a grade for the six key headers.
  3. 3Copy the fix for nginx, Apache or IIS.

What this checks

The six response headers that do most to protect visitors: Strict-Transport-Security (HTTPS only), Content-Security-Policy (where scripts may load from), X-Frame-Options (no clickjacking), X-Content-Type-Options (no MIME sniffing), Referrer-Policy and Permissions-Policy. It also checks that plain HTTP redirects to HTTPS, that the TLS certificate is trusted and not about to expire, which TLS version is negotiated, and whether headers give away your server or framework version.

How the grade works

HSTS and CSP are worth 25 points each, X-Frame-Options and X-Content-Type-Options 15 each, and Referrer-Policy and Permissions-Policy 10 each. A header that is present but weak - a CSP that allows unsafe-inline scripts, an HSTS max-age under six months - earns half. 95 or more is an A+, 85 an A, and so on down to F. A site without HTTPS is graded F, because none of the rest can protect it.

Fixing it

For every missing or weak header, the result gives a ready-to-paste block for nginx, Apache (.htaccess) or IIS (web.config). Add them, reload, and check again. Be careful with Content-Security-Policy: a strict policy blocks any script it does not list, so roll it out as Content-Security-Policy-Report-Only first and watch for violations. Building the config from scratch? The nginx config generator includes these headers.

Only the address you enter is sent to our server, which makes one request to the site, reads the headers and certificate, and returns them. Page content is not stored. For performance rather than security, run the website speed test.

Frequently asked questions

Which security headers should every site send?+

Strict-Transport-Security (HSTS), Content-Security-Policy, X-Content-Type-Options: nosniff, a Referrer-Policy, and frame protection through X-Frame-Options or CSP frame-ancestors. The checker shows which are missing and the line to add for each.

What are HTTP security headers?+

Response headers that tell the browser how to behave with your site - only use HTTPS, refuse to be framed, only run scripts from approved places. They cost nothing and block whole classes of attack.

Which security headers are most important?+

Content-Security-Policy and Strict-Transport-Security protect the most. X-Content-Type-Options and X-Frame-Options are one line each and should always be present.

Is X-XSS-Protection still needed?+

No. Modern browsers removed the XSS filter it controlled, and the filter could itself be abused. Set it to 0 or leave it out, and use Content-Security-Policy instead.

Why is my grade lower with a CSP?+

A policy that allows 'unsafe-inline' scripts without nonces or hashes still lets most XSS attacks run, so it scores half. Replace unsafe-inline with nonces or hashes to earn the full points.

How often should I check?+

After every server, CDN or hosting change. Headers are easily lost when a config is rewritten or a new proxy is put in front of the site.

Do you store the results?+

No. The check runs when you ask for it and the result is shown only to you.

Worth reading

All articles →
Cloudflare speed settings and a benchmark comparing gzip, Brotli and zstd compressionCloudflare Speed Settings That Help, and Brotli vs Zstd vs Gzip MeasuredOur own benchmark of gzip, Brotli and zstd (body size, requests per second, CPU), and the Cloudflare settings this site runs: what is on, what is off, and what a shop must never cache.7 min readASP.NET Core deployment errors on Plesk: 500.19, 500.30 and 500.31Deploying ASP.NET Core to Plesk on Windows: Every Error I Hit and What It Actually MeantEvery guide to deploying ASP.NET Core on Plesk stops at "dotnet publish and upload the folder". Mine all went wrong after that step. Here are the five errors in the order you meet them, and what each one actually means.7 min readDeploying Next.js on IIS and Plesk: The Windows Traps Nobody DocumentsDeploying Next.js on IIS and Plesk: The Windows Traps Nobody DocumentsMost guides to running Next.js on IIS assume a VPS you control and a reverse proxy to PM2. On Plesk shared Windows hosting you have neither. Here is the setup that works, and the four failures that cost me the most time.8 min read

More Website Checks

View all →
Redirect CheckerTrace every redirect hop with status codes and timings, and check the http/https and www versions of your address.Robots.txt ValidatorFetch or paste a robots.txt, find its errors and test any URL against it for Googlebot, Bingbot and AI crawlers.XML Sitemap ValidatorCheck an XML sitemap or sitemap index the way search engines read it - format, URLs, dates and limits.