For site owners and developers

Check your website's security headers

The Security Headers Checker fetches any public web page and reports which HTTP security headers it sends: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, Referrer-Policy, Permissions-Policy and more. You get a grade from A+ to F, what each header protects against and the value to set.

Free, no sign-up
Results in seconds
Input not stored

mohitgoyal.in/tools/security-headers-checkerFree · No AI

Security Headers Checker

Grade a website's HTTP security headers

Result · Ready

Your result will appear here

Fill in the form, or press Try an example to see what you get:

A grade from A+ to F
Which security headers are present, weak or missing
The exact value each header sends
What each header protects against, in plain English
A recommended value for every header
Headers that give away your server software

How it works

How to use the Security Headers Checker

Enter the address
Type or paste the page you want to check, such as your home page. The https:// is optional.
Run the check
The checker requests the page from the server, follows up to 3 redirects and reads the response headers.
Fix what's missing
Each header shows its status, the value your site sends, what it protects against and the value to set.

What you get

Inside every result

A grade from A+ to F
Which security headers are present, weak or missing
The exact value each header sends
What each header protects against, in plain English
A recommended value for every header
Headers that give away your server software

Who it's for

Built for

Site owners asked to pass a security scan
WordPress owners checking a site after a plugin or host change
Developers reviewing a release before launch
Agencies auditing a client's website

Why security headers matter

Security headers are instructions your server sends with every page. The browser enforces them for you: only load this site over HTTPS, don't let other sites frame this page, don't guess file types, don't send full URLs to other sites.

A few lines of configuration close off whole classes of attack such as clickjacking, content sniffing and cross-site scripting. Many sites never switch them on.

How the grade works

Each header has a weight out of 100: Content-Security-Policy 25, Strict-Transport-Security 20, X-Frame-Options or frame-ancestors 15, X-Content-Type-Options 10, Referrer-Policy 10, Permissions-Policy 10, Cross-Origin-Opener-Policy 5 and Cross-Origin-Resource-Policy 5. A header that is present but weak earns half.

A Server header with a version number, or any X-Powered-By header, costs 5 points each. The score becomes a grade: A+ from 95, A from 85, B from 70, C from 55, D from 40 and F below that.

How to add the missing headers

On Apache, add them to .htaccess; on Nginx, add an add_header line per header to the server block; on Next.js, return them from the headers option in next.config. On WordPress, a plugin can send them without touching server files.

Switch on the safe headers first. Add Content-Security-Policy last, in report-only mode, because a strict policy can block scripts and embeds your site needs.

Guides and services

Questions

Frequently asked

What are HTTP security headers?+

Response headers that tell the browser how to protect visitors on your site, such as forcing HTTPS (Strict-Transport-Security), blocking injected scripts (Content-Security-Policy) and preventing clickjacking (X-Frame-Options).

Is this checker free? Does it use AI?+

Yes, it is free with no sign-up. It does not use AI: it reads the headers your server sends and compares them with fixed rules, and the explanations and recommended values are written by hand.

Is the address I enter stored?+

No. It is used only to request that page's headers, and it is not stored on this site.

Why can't it check localhost or my intranet?+

It only checks public websites on the standard ports. Private networks, internal IP ranges and other ports are blocked so the checker can't be used to reach systems behind a firewall.

Does it check every page on my site?+

No, only the page you enter, after following up to 3 redirects. Headers usually come from the server config or a plugin, so most pages send the same ones, but check key pages if your setup differs.

How do I add the missing headers on WordPress?+

Add them to your server config, or use a plugin. I wrote the free HTTP Security Header plugin for WordPress, which sends them from a settings screen with safe defaults.

More free tools

Try another tool

All 21 tools →

Free

AI Crawler Checker

Check whether your robots.txt allows or blocks GPTBot, ClaudeBot, PerplexityBot, Google-Extended and other AI crawlers, and whether your llms.txt is set up.

Use the tool

Free

Redirect Map Builder

Paste old WordPress URLs or old and new pairs and get a redirects() array for next.config.js, with warnings for chains, loops, duplicates and query strings.

Use the tool

Free