Free tools
Security Headers Check
Grade a site's security headers from a response you fetched yourself. Run the command below, paste what it prints, and each header is checked with what it means and what to change.
A web page can't fetch another site's headers without a server in the middle to relay them, and we would rather not run one that sees the URLs you test. So you fetch the headers and this page reads them. No network. Nothing you enter leaves this tab.
1. Get the headers
Command
Enter a URL to get the command.
It sends one GET request from your machine, prints the response headers and discards the body. Add -L to follow redirects; the last response is the one graded. Or use your browser: open devtools, Network tab, reload, select the first document request and copy its response headers.
2. Paste and grade
Results
The grade and each finding appear here.
Reading the results
- Strict-Transport-Security
- Keeps browsers on HTTPS after the first visit, which stops SSL stripping on hostile networks. Aim for max-age of a year with includeSubDomains. preload is a deliberate, hard to reverse step, so it is a note, not a fault.
- Content-Security-Policy
- The backstop that stops an injection from running script. This check only confirms a policy exists and counts serious gaps; the CSP evaluator reads it line by line.
- X-Content-Type-Options
- nosniff stops browsers guessing a file type, so an uploaded text file cannot be run as script.
- X-Frame-Options or frame-ancestors
- Without one of them, another site can frame the page and trick a signed-in user into clicking (clickjacking). frame-ancestors is the modern one; ALLOW-FROM is ignored by current browsers.
- Referrer-Policy
- Controls how much of the URL other sites see when users follow a link. unsafe-url leaks paths and query strings, which is where reset tokens tend to live.
- Permissions-Policy
- Switches off camera, microphone, location and similar features for the page and anything it frames. Low risk when missing, cheap to add.
- Cache-Control on sensitive pages
- Tick the box when the page shows account or personal data. Those pages need no-store, or a shared cache can hand one user's page to another.
- Set-Cookie flags
- Secure keeps the cookie off plain http, HttpOnly keeps it away from script (and XSS), and SameSite limits cross-site sending. Session cookies need all three. Only cookie names appear in the results.
The letter grade is a rough summary that drops for each finding by severity. Headers are cheap hardening, not proof the application is safe: a site can score an A and still have an injection bug behind the login. Version numbers in Server or X-Powered-By are flagged too, because they tell scanners where to start.