HTTP Security Headers Checker
Enter your URL and get a real grade for your site's HTTP security headers in seconds. See exactly which ones are missing and why they matter.
HTTP security headers tell the browser how to handle your site: whether it can be loaded in a frame on another domain, whether connections must stay encrypted, whether scripts from unapproved sources are allowed to run. Most of them take one line to add, and most sites are missing at least a few. This checker fetches your live response headers and grades them on the spot.
What this checker grades
Strict-Transport-Security (HSTS)
Forces browsers to use HTTPS for every future visit, even if someone types or links to the plain http:// version of your site.
Content-Security-Policy
Restricts which domains scripts, styles and other resources can load from, which limits the damage an injected script can do.
X-Frame-Options
Controls whether your pages can be loaded inside a frame on someone else's site, the mechanism behind clickjacking attacks.
X-Content-Type-Options
Stops browsers from guessing a file's type instead of trusting the declared Content-Type, closing off a class of MIME-sniffing attacks.
Referrer-Policy
Decides how much of your page URL gets sent to the sites your links point to. Without it, full URLs (sometimes containing tokens or IDs) can leak.
Permissions-Policy
Lets you switch off browser features like camera, microphone or geolocation for your own pages and any embedded content that doesn't need them.
Cross-origin isolation headers
Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy and Cross-Origin-Embedder-Policy, which isolate your page from other origins in the browser.
Why HTTP headers matter more than most people think
Headers are the part of a web response nobody sees, which is exactly why they get skipped. A developer ships the HTML, the CSS, the JavaScript, and moves on. But headers are what tell the browser how to defend the page once it's loaded: what it's allowed to embed, where scripts can come from, whether the connection has to stay encrypted. Skipping them doesn't break the site. It just leaves a few doors unlocked.
What a missing header actually costs you
None of these headers fix a bug by themselves. They limit what an attacker can do once something else has already gone wrong, like an XSS vulnerability in a form field or a compromised third-party script. A site with a solid Content-Security-Policy can survive an injected script that would otherwise run freely. A site without X-Frame-Options can be wrapped in an invisible frame and used for clickjacking. These are the checks security scanners and browser extensions flag first, because they're both easy to verify and easy to fix.
- •Most headers are a single response line, no application code changes needed
- •They can usually be set at the server or CDN level (nginx, Apache, Cloudflare, Vercel)
- •A missing header rarely causes a visible bug, so it tends to stay missing until someone checks
How to add these headers
Where you set headers depends on how the site is served. On Vercel or Netlify, you add them in the platform config (vercel.json, netlify.toml or next.config's headers() function). On a server you control, they go in the nginx or Apache config for that vhost. If the site sits behind Cloudflare or another CDN, you can often add or override headers there without touching the origin server at all.
Frequently asked questions
Related compliance tools
Website Security Scan
Run all 27 security checks: SSL/TLS, cookies, DNS/email authentication and server configuration.
GDPR Article 32: Website Security Technical Measures
What GDPR actually requires in terms of technical security measures for a website.
Website Compliance Checklist
A single checklist covering GDPR, the EU AI Act and accessibility for website owners.
Email Security Checker
Free live grade for your SPF, DMARC and DKIM email authentication records.