Security Headers Checker
Scan any website's HTTP response headers and get a security grade from A+ to F, with copy-paste fixes for anything missing — plus the HTTP version it negotiates.
Why HTTP security headers matter
A handful of response headers tell the browser how to protect your users. Get them right and you close off whole classes of attack — cross-site scripting, clickjacking, protocol downgrades and data leakage:
- Strict-Transport-Security forces HTTPS so a user can't be downgraded to HTTP.
- Content-Security-Policy is the single most effective defence against XSS — it controls what can load and run on your page.
- X-Frame-Options (or CSP
frame-ancestors) stops your site being framed for clickjacking. - X-Content-Type-Options: nosniff stops MIME-type sniffing.
- Referrer-Policy and Permissions-Policy limit what leaks and what powerful features pages may use.
Detecting the negotiated HTTP/2 or HTTP/3 version needs a real connection from a server — a browser can't report another site's protocol. Found something missing? The exact header to add is shown above; drop it into your nginx, Apache or CDN config.