Security Headers Checker: Grade Your HTTP Response Headers
This free security headers checker grades the HTTP security headers of any public website from A+ to F. Enter a URL and it fetches the headers, shows which protections are missing, and writes the configuration to fix them for nginx, Apache, IIS, WordPress, Cloudflare and more. You get a score out of 100 and a short list of what to fix first. For a staging site or a page behind a login, paste the headers yourself and they are graded in your browser without leaving it.
- Free
- No signup
- Runs in your browser
- Grade A+ to F
- Config for 9 platforms
curl -sI https://yourdomain.com, or copy them from your browser: open developer tools, go to Network, click the first request and copy the response headers.How it works
- 1Enter your addressType your website address and we fetch its headers. Paste them instead for private sites.
- 2Get a gradeTen groups of protections are scored, with the fixes ranked by how many points they win back.
- 3Copy the fixChoose nginx, Apache, IIS, WordPress, Cloudflare and more, and copy ready-made configuration.
How this security headers checker grades your headers
The security headers checker takes the response headers of your URL (or the headers you paste), tests ten groups of protections, and turns the result into a score out of 100 and a grade from A+ to F. Each group has a weight, so a missing Content-Security-Policy costs more than a missing Referrer-Policy. Checks that do not apply are left out and the score is rescaled, for example when you tick the API option or when the response sets no cookies. If the address redirects, the final response is graded and the chain is shown. With Follow redirects off, the first response is graded instead.
The security headers it checks
These are the HTTP security headers the tool looks for, what each one does, and the value to aim for.
| Header | What it does | Recommended value |
|---|---|---|
| Strict-Transport-Security (HSTS) | Makes browsers use HTTPS only and blocks protocol downgrade and cookie hijacking on public Wi-Fi. | max-age=31536000; includeSubDomains |
| Content-Security-Policy (CSP) | Lists which sources may load scripts, styles, images and frames, which limits cross-site scripting (XSS) and data injection. | default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none' |
| X-Frame-Options | Stops other sites from putting your page in a frame, which prevents clickjacking. CSP frame-ancestors is the modern equivalent. | DENY or SAMEORIGIN |
| X-Content-Type-Options | Stops the browser guessing a file's type, which blocks MIME-sniffing attacks. | nosniff |
| Referrer-Policy | Controls how much of the page URL is sent to other sites when a visitor clicks a link. | strict-origin-when-cross-origin |
| Permissions-Policy | Switches off browser features such as camera, microphone and geolocation for your page and its embeds. | camera=(), microphone=(), geolocation=() |
| Cross-Origin-Opener-Policy (COOP) | Isolates your window from pop-ups opened by other sites, which helps against cross-origin leaks. | same-origin |
| Cross-Origin-Resource-Policy (CORP) | Tells browsers which sites may load your resources, which helps against Spectre-style leaks. | same-site |
| Set-Cookie flags | Secure keeps cookies off plain HTTP, HttpOnly hides them from scripts, SameSite limits cross-site sending. | Secure; HttpOnly; SameSite=Lax |
How the grade is calculated
The score is the share of weighted points your headers earn. An A+ is 98 or more, A is 90 to 97, B is 75 to 89, C is 60 to 74, D is 40 to 59 and F is below 40.
| Check | How it scores | Weight |
|---|---|---|
| Content-Security-Policy | No policy 0. Report-Only only 20%. Present: points are removed for unsafe-inline, unsafe-eval, wildcard script sources, and a missing object-src, base-uri or frame-ancestors. | 25 |
| Strict-Transport-Security | Missing or max-age 0: 0. Under 6 months: 40%. Under 1 year or no includeSubDomains: 85%. 1 year or more with includeSubDomains: full. | 15 |
| X-Frame-Options or frame-ancestors | DENY, SAMEORIGIN or CSP frame-ancestors: full. ALLOW-FROM: half. Missing: 0. | 10 |
| X-Content-Type-Options | nosniff: full. Otherwise 0. | 10 |
| Cookie flags | Share of cookies with Secure, SameSite and (for session cookies) HttpOnly. Skipped if the response sets no cookie. | 10 |
| Referrer-Policy | A strict policy: full. Not set: 60%. A leaky policy: 60%. unsafe-url: 0. | 8 |
| Information leaks | 34% off for each of Server with a version, X-Powered-By, X-AspNet-Version and X-Generator. | 7 |
| Permissions-Policy | Present: full. Feature-Policy only: half. Missing: 0. | 5 |
| Cross-origin isolation | COOP, CORP and COEP: all three full, two 85%, one half, none 0. | 5 |
| CORS | Scored only if Access-Control-Allow-Origin is present. * with credentials or null: 0. * alone: 70%. Named origin: full. | 5 |
How to get your response headers by hand
The scan service can only reach public websites. For a staging server, an internal site, a page behind a login or a site that blocks scanners, copy the headers yourself. The quickest way is curl.
curl -sI https://yourdomain.comYou can also open your browser's developer tools, choose the Network tab, reload the page, click the first request and copy the response headers. On Windows PowerShell, (Invoke-WebRequest https://yourdomain.com -Method Head).Headers lists them. Check the homepage and a page after login, because they often differ, then paste the result into the box above.
How to add security headers to your server
Add the headers where your site is served: the web server, the CDN or the application. The Generate tab above writes the exact lines for each platform.
- nginx:
add_headerlines with thealwaysflag in the server block. - Apache:
Header always setlines in .htaccess or the virtual host, with mod_headers enabled. - WordPress: a PHP snippet on the
send_headershook, or the server config of your host. - Cloudflare: a Transform Rule that modifies response headers, and the HSTS switch under SSL/TLS.
- Static hosts: a
_headersfile on Netlify and Cloudflare Pages, orvercel.jsonon Vercel.
Common security header mistakes
Most weak scores come from the same few mistakes.
- A Content-Security-Policy with unsafe-inline: it looks like protection but lets injected scripts run. Use nonces or hashes instead.
- Wildcards in CSP:
*,https:anddata:in script-src allow almost any host to supply code. - HSTS with a tiny max-age: a value of a few minutes gives almost no protection. Move to one year once HTTPS works everywhere.
- Preload added too early: the browser preload list is hard to leave, so add preload only when every subdomain supports HTTPS.
- CORS with a wildcard and credentials:
Access-Control-Allow-Origin: *next toAllow-Credentials: trueis a misconfiguration. - Obsolete headers: X-XSS-Protection, Expect-CT and Public-Key-Pins should be removed.
- Version details left in Server and X-Powered-By: they tell attackers which exploits to try.
Security headers and security standards
Security headers are a baseline control in the OWASP Secure Headers Project and the OWASP Application Security Verification Standard (ASVS). Missing or weak headers fall under A05:2021 Security Misconfiguration in the OWASP Top 10. The headers are defined in specifications such as RFC 6797 for HSTS, the W3C Content Security Policy and Referrer Policy specifications, and the Permissions Policy specification, and MDN documents how each browser handles them.
Headers only harden the browser side of your site. They do not fix a vulnerable application. Pair them with a website vulnerability scan, and use the email security checker for the DNS side of your domain.
Frequently asked questions
What are HTTP security headers?
HTTP security headers are instructions a web server sends with every response that tell the browser how to handle the page safely. They switch on protections such as forced HTTPS, blocking of injected scripts, clickjacking prevention and tighter cookie handling. They cost nothing to add and close common weaknesses that scanners and OWASP list under security misconfiguration.Which security headers are the most important?
Content-Security-Policy and Strict-Transport-Security matter most, followed by X-Content-Type-Options, a clickjacking control (X-Frame-Options or CSP frame-ancestors) and Referrer-Policy. Add Permissions-Policy and the cross-origin headers as extra hardening. Cookie flags and removing version details from the Server and X-Powered-By headers complete a solid baseline.What is a good security headers grade?
An A+, A or B means the important headers are present and not weakened. A C means gaps remain, most often a missing or weak Content-Security-Policy. Anything below that means several protections are missing. A perfect score is not required, but every Fail row in the results is a cheap fix.Can the checker scan my website by URL?
Yes. Enter your address and ScanTitan's scan service requests the page once and reads its response headers, then the tool grades them. It only reaches public websites, so for a staging server, an internal site or a page behind a login, paste the headers instead. You can get them with curl -sI followed by your address, or from the Network tab in your browser's developer tools.How do I add security headers in nginx, Apache or WordPress?
Use the Generate tab. Choose your platform, set the options, and copy the result. It writes add_header lines for nginx, Header always set lines for Apache, a web.config block for IIS, a Caddyfile block, Express code, a Netlify or Cloudflare Pages _headers file, vercel.json, a WordPress PHP snippet, and the values for a Cloudflare Transform Rule.How do I start with Content-Security-Policy without breaking my site?
Send the policy as Content-Security-Policy-Report-Only first. It blocks nothing, but the browser console lists everything that would have been blocked. Fix or allow each item, then switch the header name to Content-Security-Policy. Avoid unsafe-inline for scripts, and use nonces or hashes if you need inline code.Is X-XSS-Protection still needed?
No. Modern browsers removed the XSS auditor it controlled, and in some old browsers it could even introduce vulnerabilities. Remove it or set it to 0, and use Content-Security-Policy instead.Is my website address stored by ScanTitan?
No. When you enter a URL, ScanTitan's scan service requests that page once to read its headers and returns them to your browser. It does not store the address or the result. Headers you paste yourself are graded in your browser and never leave it.Headers harden the browser side. Find the vulnerabilities in the application behind them.
Run a free website scanSee pricing