Knowledge Mark G
Hire Me

Free SEO tool

Security Headers Checker

Grade a site's HTTP security headers, HTTPS redirect and TLS certificate - with the exact fix for each problem.

  • No sign-up
  • Instant results
  • Only the address is sent

Check a site

We request the page once, read the response headers and open a TLS connection to inspect the certificate. Page content is not stored.

Enter an address to grade its HTTP security headers, HTTPS redirect and certificate.

What this checks

The six response headers that do most to protect visitors: Strict-Transport-Security (HTTPS only), Content-Security-Policy (where scripts may load from), X-Frame-Options (no clickjacking), X-Content-Type-Options (no MIME sniffing), Referrer-Policy and Permissions-Policy. It also checks that plain HTTP redirects to HTTPS, that the TLS certificate is trusted and not about to expire, which TLS version is negotiated, and whether headers give away your server or framework version.

How the grade works

HSTS and CSP are worth 25 points each, X-Frame-Options and X-Content-Type-Options 15 each, and Referrer-Policy and Permissions-Policy 10 each. A header that is present but weak - a CSP that allows unsafe-inline scripts, an HSTS max-age under six months - earns half. 95 or more is an A+, 85 an A, and so on down to F. A site without HTTPS is graded F, because none of the rest can protect it.

Fixing it

For every missing or weak header, the result gives a ready-to-paste block for nginx, Apache (.htaccess) or IIS (web.config). Add them, reload, and check again. Be careful with Content-Security-Policy: a strict policy blocks any script it does not list, so roll it out as Content-Security-Policy-Report-Only first and watch for violations. Building the config from scratch? The nginx config generator includes these headers.

Only the address you enter is sent to our server, which makes one request to the site, reads the headers and certificate, and returns them. Page content is not stored. For performance rather than security, run the website speed test.

Questions people ask

What are HTTP security headers?+

Response headers that tell the browser how to behave with your site - only use HTTPS, refuse to be framed, only run scripts from approved places. They cost nothing and block whole classes of attack.

Which security headers are most important?+

Content-Security-Policy and Strict-Transport-Security protect the most. X-Content-Type-Options and X-Frame-Options are one line each and should always be present.

Is X-XSS-Protection still needed?+

No. Modern browsers removed the XSS filter it controlled, and the filter could itself be abused. Set it to 0 or leave it out, and use Content-Security-Policy instead.

Why is my grade lower with a CSP?+

A policy that allows 'unsafe-inline' scripts without nonces or hashes still lets most XSS attacks run, so it scores half. Replace unsafe-inline with nonces or hashes to earn the full points.

How often should I check?+

After every server, CDN or hosting change. Headers are easily lost when a config is rewritten or a new proxy is put in front of the site.

Do you store the results?+

No. The check runs when you ask for it and the result is shown only to you.