Cómo usar: Security Headers Checker
- Enter the website URL and click Scan headers. We follow redirects and analyze the final response.
- Read the grade and the per-header table — each failing header explains the risk and the recommended value.
- Pick your platform (Nginx, Apache, Netlify, Vercel or Cloudflare) and copy the generated snippet for the missing headers.
- Deploy, then scan again. Test a strict Content-Security-Policy in
Report-Onlymode first so you don’t break scripts.
What are HTTP security headers?
Security headers are HTTP response headers that tell the browser to enable built-in protections: always use HTTPS, refuse to render the page inside a hostile frame, only run scripts from trusted sources, don't guess file types, and limit what is leaked in the Referer header. They cost nothing to add, require no code changes in most cases, and close whole classes of attacks such as clickjacking, protocol downgrades and many cross-site scripting (XSS) payloads.
How the grade is calculated
Each of six headers carries points. The total (0–100) maps to a grade: A+ from 90, A from 75, B from 60, C from 45, D from 30, E from 15, otherwise F. Sites not served over HTTPS are capped at 20 points.
| Header | Points | Protects against | Recommended value |
|---|---|---|---|
| Strict-Transport-Security | 25 | Downgrade to HTTP, SSL stripping, cookie theft on public Wi-Fi | max-age=31536000; includeSubDomains (at least 180 days to pass) |
| Content-Security-Policy | 25 | XSS, data injection, unwanted third-party scripts | A policy tailored to your site, e.g. starting from default-src 'self' |
| X-Content-Type-Options | 15 | MIME sniffing that turns uploads into executable scripts | nosniff |
| X-Frame-Options | 15 | Clickjacking via hidden iframes | SAMEORIGIN, or CSP frame-ancestors 'self' |
| Referrer-Policy | 10 | Leaking full URLs (with tokens or search terms) to other sites | strict-origin-when-cross-origin |
| Permissions-Policy | 10 | Embedded content abusing camera, microphone, geolocation | camera=(), microphone=(), geolocation=() |
We also flag information-leaking headers such as Server: Apache/2.4.41 or X-Powered-By: PHP/8.1. Exact version numbers help attackers match known vulnerabilities; remove or shorten them.
Adding headers on popular platforms
After a scan, the tool generates snippets containing only the headers you are missing: add_header … always; for Nginx, Header always set for Apache (.htaccess or vhost), a _headers file for Netlify and Cloudflare Pages, the headers array in vercel.json, and a Cloudflare Worker or Transform Rule for sites behind Cloudflare.
Webflow, Squarespace, Wix and similar hosted builders generally don't let you set custom response headers on standard plans. The common solution is to put a reverse proxy in front of the site — for example, proxy the domain through Cloudflare and add the headers with a Transform Rule or Worker.
Roll out CSP and HSTS carefully
A strict Content-Security-Policy can block analytics, chat widgets or inline scripts. Deploy it first as Content-Security-Policy-Report-Only, watch the browser console for violations, and tighten it before enforcing. HSTS is cached by browsers for the whole max-age, so start with a short value (e.g. one day) if subdomains might still need plain HTTP. For the rest of the response, inspect every header with the HTTP Header Checker and verify certificates with the SSL Checker.
También se busca como: security headers, hsts checker, csp checker, http headers security, x-frame-options, content security policy, header scanner, securityheaders.
Herramientas que combinan con: Security Headers Checker
- CORS Header Generator & Tester — Seeing “has been blocked by CORS policy”?
- Redirect Checker — Follow a URL hop by hop to see every redirect, its status code and timing, and check that the http, https, www and non-www versions of your domain all end at one canonical address.
- Verificador SEO y auditoría del sitio web — Pega una URL para realizar hasta 70 comprobaciones de SEO on-page, además de una auditoría completa del sitio web: velocidad de Lighthouse, encabezados de seguridad y SSL, datos estructurados, enlaces rotos, robots.txt y rastreadores de IA, aspectos básicos de accesibilidad, seguimiento y consentimiento, SPF/DKIM/DMARC y caducidad del dominio — todo ello resumido en una puntuación global del sitio web con soluciones priorizadas.
- Page Speed Test — Run Google Lighthouse on any URL for mobile or desktop.
Preguntas frecuentes
Do security headers affect SEO?
Is X-XSS-Protection still needed?
X-XSS-Protection: 0 is the recommended value.How do I add security headers to a Webflow site?
Will a Content-Security-Policy break my site?
Content-Security-Policy-Report-Only, fix the reported violations, then switch to the enforcing header.