devpack
Site Audit

Security Headers Checker

Grade a site’s HTTP security headers from A+ to F, see which are missing and why they matter, and copy ready-made config snippets for Nginx, Apache, Netlify, Vercel or Cloudflare.

Runs on our server

What the Security Headers Checker grades

Enter any public URL above and press Enter or Ctrl + Enter.

  • Strict-Transport-Security (HSTS)
  • Content-Security-Policy
  • X-Content-Type-Options
  • X-Frame-Options / frame-ancestors
  • Referrer-Policy
  • Permissions-Policy
  • Version-leaking headers
  • Config snippets for 5 platforms
Try:

This tool fetches the public URL you enter from our server. Results are held in temporary memory for a few minutes and never stored in a database.

How to use the Security Headers Checker

  1. Enter the website URL and click Scan headers. We follow redirects and analyse the final response.
  2. Read the grade and the per-header table — each failing header explains the risk and the recommended value.
  3. Pick your platform (Nginx, Apache, Netlify, Vercel or Cloudflare) and copy the generated snippet for the missing headers.
  4. Deploy, then scan again. Test a strict Content-Security-Policy in Report-Only mode first so you don’t break scripts.

What are HTTP security headers?

Security headers are HTTP response headers that tell the browser to enable built-in protections: always use HTTPS, refuse to render the page inside a hostile frame, only run scripts from trusted sources, don't guess file types, and limit what is leaked in the Referer header. They cost nothing to add, require no code changes in most cases, and close whole classes of attacks such as clickjacking, protocol downgrades and many cross-site scripting (XSS) payloads.

How the grade is calculated

Each of six headers carries points. The total (0–100) maps to a grade: A+ from 90, A from 75, B from 60, C from 45, D from 30, E from 15, otherwise F. Sites not served over HTTPS are capped at 20 points.

HeaderPointsProtects againstRecommended value
Strict-Transport-Security25Downgrade to HTTP, SSL stripping, cookie theft on public Wi-Fimax-age=31536000; includeSubDomains (at least 180 days to pass)
Content-Security-Policy25XSS, data injection, unwanted third-party scriptsA policy tailored to your site, e.g. starting from default-src 'self'
X-Content-Type-Options15MIME sniffing that turns uploads into executable scriptsnosniff
X-Frame-Options15Clickjacking via hidden iframesSAMEORIGIN, or CSP frame-ancestors 'self'
Referrer-Policy10Leaking full URLs (with tokens or search terms) to other sitesstrict-origin-when-cross-origin
Permissions-Policy10Embedded content abusing camera, microphone, geolocationcamera=(), microphone=(), geolocation=()

We also flag information-leaking headers such as Server: Apache/2.4.41 or X-Powered-By: PHP/8.1. Exact version numbers help attackers match known vulnerabilities; remove or shorten them.

Adding headers on popular platforms

After a scan, the tool generates snippets containing only the headers you are missing: add_header … always; for Nginx, Header always set for Apache (.htaccess or vhost), a _headers file for Netlify and Cloudflare Pages, the headers array in vercel.json, and a Cloudflare Worker or Transform Rule for sites behind Cloudflare.

Webflow, Squarespace, Wix and similar hosted builders generally don't let you set custom response headers on standard plans. The common solution is to put a reverse proxy in front of the site — for example, proxy the domain through Cloudflare and add the headers with a Transform Rule or Worker.

Roll out CSP and HSTS carefully

A strict Content-Security-Policy can block analytics, chat widgets or inline scripts. Deploy it first as Content-Security-Policy-Report-Only, watch the browser console for violations, and tighten it before enforcing. HSTS is cached by browsers for the whole max-age, so start with a short value (e.g. one day) if subdomains might still need plain HTTP. For the rest of the response, inspect every header with the HTTP Header Checker and verify certificates with the SSL Checker.

Tools that pair well with the Security Headers Checker

  • Redirect Checker — Follow a URL hop by hop to see every redirect, its status code and timing, and check that the http, https, www and non-www versions of your domain all end at one canonical address.
  • SEO Checker & Site Audit — Paste a URL to run up to 70 on-page SEO checks in seconds.
  • Page Speed Test — Run Google Lighthouse on any URL for mobile or desktop.
  • Meta Tag Checker — See exactly how Google is likely to display your page: title and description measured in pixels, desktop and mobile previews, and every meta tag in the <head>.

Frequently asked questions

Do security headers affect SEO?
They are not a direct ranking factor, except that HTTPS itself is a lightweight signal and HSTS enforces it. They protect visitors and your reputation — a hacked site injecting spam will lose rankings fast.
Is X-XSS-Protection still needed?
No. Modern browsers have removed the XSS auditor that this header controlled, so it is not graded. Use a Content-Security-Policy instead; if you still send the header, X-XSS-Protection: 0 is the recommended value.
How do I add security headers to a Webflow site?
Standard Webflow hosting doesn’t support custom response headers. Route the domain through a reverse proxy such as Cloudflare and add the headers there with a Transform Rule (Modify Response Header) or a small Worker.
Will a Content-Security-Policy break my site?
It can, if it doesn’t list all the domains your scripts, styles, fonts and frames come from. Start with Content-Security-Policy-Report-Only, fix the reported violations, then switch to the enforcing header.
Why does my grade differ from other scanners?
Scanners weight headers differently and some grade additional ones. The six headers here are the widely agreed essentials; the per-header table matters more than the letter.

Related tools

HTTP Header CheckerFetch any URL and see exactly what the server sends back — status code, redirect chain and every response…SSL CheckerVerify an HTTPS certificate in seconds — see when it expires, who issued it, which hostnames it covers and…Redirect CheckerFollow a URL hop by hop to see every redirect, its status code and timing, and check that the http, https,…SEO Checker & Site AuditPaste a URL to run up to 70 on-page SEO checks in seconds. You get a score, a prioritised list of issues…Page Speed TestRun Google Lighthouse on any URL for mobile or desktop. See performance, accessibility, best-practices and…Meta Tag CheckerSee exactly how Google is likely to display your page: title and description measured in pixels, desktop…