HTTP Security Headers
Grade HSTS, CSP, X-Frame and other security headers.
Enter a target
e.g. example.com — press ⏎ / ⌘⏎
What is HTTP Security Headers?
The HTTP Security Headers tool grades your site's response headers for HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
It doesn't just check presence, it grades values: a short HSTS max-age or a CSP containing 'unsafe-inline' cancels most of the protection and scores partially even though the header exists.
The request starts on plain HTTP so the HTTPS upgrade is measured rather than assumed. The full redirect chain, per-hop timing, and cookie Secure/HttpOnly/SameSite flags are listed too.
Frequently Asked Questions
9 questionsWhich security header matters most?
By weight, Content-Security-Policy (the main XSS defense) and HSTS (forces HTTPS). Getting these two right raises your score the most.
I got an A+ — is my site fully secure?
No. This test only evaluates response headers; application vulnerabilities (SQL injection, auth flaws) are out of scope. Headers are one important layer, not the whole story.
How do I add these headers?
add_header in Nginx, Header set in Apache, headers() in next.config for Next.js — or via your CDN's dashboard. Roll out CSP in Report-Only mode first.
Is X-XSS-Protection still needed?
Modern browsers ignore it; CSP is the real protection. It carries a small weight here because it remains a harmless extra layer for legacy traffic.
Will adding a CSP break my site?
It can, if written wrong — blocked scripts fail silently. Deploy with Content-Security-Policy-Report-Only first: the policy isn't enforced but violations are reported. Switch to the real header once the reports are clean.
Can I undo HSTS after enabling it?
Not easily. Browsers remember to use HTTPS for the whole max-age and won't fall back until it expires. Start with a short max-age (say 300), confirm everything works, then raise it to a year. Preload-list entry is effectively permanent.
X-Frame-Options or CSP frame-ancestors?
frame-ancestors is the modern replacement and can allow multiple origins. Send both if you must support very old browsers; where they conflict, modern browsers honour frame-ancestors.
Should I hide Server and X-Powered-By?
Hiding them isn't a security control on its own — vulnerabilities are scanned regardless of version strings. It's still needless help to an attacker, and it costs nothing to remove, so remove it without treating it as a defence layer.
What SameSite value should cookies use?
Lax is right for most session cookies by default and gives real CSRF protection. Use None only when the cookie genuinely needs a third-party context, and always pair it with Secure.