devpack
EnglishDeutsch · StartseiteFrançais · AccueilEspañol · InicioPortuguês (Brasil) · Início
Auditoria do site

Esta página ainda não foi traduzida para o português, por isso aparece em inglês.

Security Headers Checker

Grade a site’s HTTP security headers from A+ to F, see which are missing and why they matter, and copy ready-made config snippets for Nginx, Apache, Netlify, Vercel or Cloudflare.

Atualizado em

What the Security Headers Checker grades

Enter any public URL above and press Enter or Ctrl + Enter.

  • Strict-Transport-Security (HSTS)
  • Content-Security-Policy
  • X-Content-Type-Options
  • X-Frame-Options / frame-ancestors
  • Referrer-Policy
  • Permissions-Policy
  • Version-leaking headers
  • Config snippets for 5 platforms
Try:

Esta ferramenta busca pelo nosso servidor a URL pública que você digitar. Os resultados ficam alguns minutos na memória temporária e nunca são salvos em banco de dados.

Como usar: Security Headers Checker

  1. Enter the website URL and click Scan headers. We follow redirects and analyze the final response.
  2. Read the grade and the per-header table — each failing header explains the risk and the recommended value.
  3. Pick your platform (Nginx, Apache, Netlify, Vercel or Cloudflare) and copy the generated snippet for the missing headers.
  4. Deploy, then scan again. Test a strict Content-Security-Policy in Report-Only mode first so you don’t break scripts.

What are HTTP security headers?

Security headers are HTTP response headers that tell the browser to enable built-in protections: always use HTTPS, refuse to render the page inside a hostile frame, only run scripts from trusted sources, don't guess file types, and limit what is leaked in the Referer header. They cost nothing to add, require no code changes in most cases, and close whole classes of attacks such as clickjacking, protocol downgrades and many cross-site scripting (XSS) payloads.

How the grade is calculated

Each of six headers carries points. The total (0–100) maps to a grade: A+ from 90, A from 75, B from 60, C from 45, D from 30, E from 15, otherwise F. Sites not served over HTTPS are capped at 20 points.

HeaderPointsProtects againstRecommended value
Strict-Transport-Security25Downgrade to HTTP, SSL stripping, cookie theft on public Wi-Fimax-age=31536000; includeSubDomains (at least 180 days to pass)
Content-Security-Policy25XSS, data injection, unwanted third-party scriptsA policy tailored to your site, e.g. starting from default-src 'self'
X-Content-Type-Options15MIME sniffing that turns uploads into executable scriptsnosniff
X-Frame-Options15Clickjacking via hidden iframesSAMEORIGIN, or CSP frame-ancestors 'self'
Referrer-Policy10Leaking full URLs (with tokens or search terms) to other sitesstrict-origin-when-cross-origin
Permissions-Policy10Embedded content abusing camera, microphone, geolocationcamera=(), microphone=(), geolocation=()

We also flag information-leaking headers such as Server: Apache/2.4.41 or X-Powered-By: PHP/8.1. Exact version numbers help attackers match known vulnerabilities; remove or shorten them.

Adding headers on popular platforms

After a scan, the tool generates snippets containing only the headers you are missing: add_header … always; for Nginx, Header always set for Apache (.htaccess or vhost), a _headers file for Netlify and Cloudflare Pages, the headers array in vercel.json, and a Cloudflare Worker or Transform Rule for sites behind Cloudflare.

Webflow, Squarespace, Wix and similar hosted builders generally don't let you set custom response headers on standard plans. The common solution is to put a reverse proxy in front of the site — for example, proxy the domain through Cloudflare and add the headers with a Transform Rule or Worker.

Roll out CSP and HSTS carefully

A strict Content-Security-Policy can block analytics, chat widgets or inline scripts. Deploy it first as Content-Security-Policy-Report-Only, watch the browser console for violations, and tighten it before enforcing. HSTS is cached by browsers for the whole max-age, so start with a short value (e.g. one day) if subdomains might still need plain HTTP. For the rest of the response, inspect every header with the HTTP Header Checker and verify certificates with the SSL Checker.

Também pesquisado como: security headers, hsts checker, csp checker, http headers security, x-frame-options, content security policy, header scanner, securityheaders.

Ferramentas que combinam com: Security Headers Checker

  • CORS Header Generator & Tester — Seeing “has been blocked by CORS policy”?
  • Redirect Checker — Follow a URL hop by hop to see every redirect, its status code and timing, and check that the http, https, www and non-www versions of your domain all end at one canonical address.
  • Verificador de SEO e Auditoria de Site — Cole uma URL para fazer até 70 verificações de SEO na página, além de uma auditoria completa do site: velocidade do Lighthouse, cabeçalhos de segurança e SSL, dados estruturados, links quebrados, robots.txt e rastreadores de IA, noções básicas de acessibilidade, rastreamento e consentimento, SPF/DKIM/DMARC e validade do domínio — tudo reunido em uma única pontuação do site com correções priorizadas.
  • Page Speed Test — Run Google Lighthouse on any URL for mobile or desktop.

Perguntas frequentes

Do security headers affect SEO?
They are not a direct ranking factor, except that HTTPS itself is a lightweight signal and HSTS enforces it. They protect visitors and your reputation — a hacked site injecting spam will lose rankings fast.
Is X-XSS-Protection still needed?
No. Modern browsers have removed the XSS auditor that this header controlled, so it is not graded. Use a Content-Security-Policy instead; if you still send the header, X-XSS-Protection: 0 is the recommended value.
How do I add security headers to a Webflow site?
Standard Webflow hosting doesn’t support custom response headers. Route the domain through a reverse proxy such as Cloudflare and add the headers there with a Transform Rule (Modify Response Header) or a small Worker.
Will a Content-Security-Policy break my site?
It can, if it doesn’t list all the domains your scripts, styles, fonts and frames come from. Start with Content-Security-Policy-Report-Only, fix the reported violations, then switch to the enforcing header.
Why does my grade differ from other scanners?
Scanners weight headers differently and some grade additional ones. The six headers here are the widely agreed essentials; the per-header table matters more than the letter.

Ferramentas relacionadas

apiCORS Header Generator & TesterSeeing “has been blocked by CORS policy”? Describe who may call your API — origins, methods, headers,…apiHTTP Header CheckerFetch any URL and see exactly what the server sends back — status code, redirect chain and every response…apiSSL CheckerVerify an HTTPS certificate in seconds — see when it expires, who issued it, which hostnames it covers and…apiRedirect CheckerFollow a URL hop by hop to see every redirect, its status code and timing, and check that the http, https,…apiVerificador de SEO e Auditoria de SiteCole uma URL para fazer até 70 verificações de SEO na página, além de uma auditoria completa do site:…apiPage Speed TestRun Google Lighthouse on any URL for mobile or desktop. See performance, accessibility, best-practices and…