Security Headers Checker
Enter a URL to scan its response for the security headers that matter — Content-Security-Policy, HSTS, X-Frame-Options and the rest — and get a grade plus what to fix
The Ten Security Headers, and What to Set Them To
Every header below is one the checker grades, listed with the points it carries out of 100, what it actually defends against, and the value to send if you have no reason to send something else. Weights are not arbitrary — a missing Content-Security-Policy costs four times what a missing Cross-Origin-Resource-Policy does, because it leaves four times more open.
Content-Security-Policy20 points
Declares which origins the page may load scripts, styles, images, fonts, and frames from. A script injected from an origin you did not approve is refused by the browser, whatever put it on the page.
Recommended value: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'
Keeping 'unsafe-inline' in script-src gives up most of the protection — an injected inline script still runs. Move inline handlers into files, or adopt a nonce, before you rely on CSP as an XSS defence.
Strict-Transport-Security15 points
Tells the browser to reach this site over HTTPS only, for the duration in max-age. It closes the window where a user typing an http:// address could be intercepted before the redirect fires.
Recommended value: max-age=63072000; includeSubDomains; preload
A max-age under one year (31536000) is generally treated as too short to be effective. Only add preload once you are certain every subdomain can serve HTTPS — removal from the preload list takes months.
X-Content-Type-Options10 points
With the value nosniff, stops the browser guessing that a file is a script or stylesheet when the Content-Type said it was not. Blocks a class of attacks that smuggle executable content past an upload filter.
Recommended value: nosniff
There is one valid value and essentially no reason not to send it. If uploads are served from your main origin, this header matters more than usual.
X-Frame-Options10 points
Stops other sites embedding yours in a frame, which is the mechanism behind clickjacking — an invisible frame of your app positioned under the attacker’s buttons.
Recommended value: DENY
Use SAMEORIGIN if your own pages frame each other. CSP's frame-ancestors directive supersedes this header and allows an allowlist; sending both covers older browsers.
Referrer-Policy10 points
Controls how much of the current URL is passed to other sites in the Referer header. Without it, path and query string — often including tokens or IDs — leak to every external link and third-party resource.
Recommended value: strict-origin-when-cross-origin
This value sends the full URL to your own origin, only the origin to other HTTPS sites, and nothing when downgrading to HTTP. It is the modern browser default, but sending it explicitly stops older browsers falling back to leakier behaviour.
Permissions-Policy10 points
Declares which browser features the page and anything it frames may use — camera, microphone, geolocation, payment. An empty allowlist turns the feature off for the whole document, including embedded third-party frames.
Recommended value: camera=(), microphone=(), geolocation=(), payment=()
Deny what you do not use. If a third-party widget you embed starts asking for the camera, this header is what stops it. Replaces the older Feature-Policy header.
X-XSS-Protection5 points
Switches on the legacy XSS filter built into older browsers. Modern engines removed the filter entirely because it caused its own vulnerabilities.
Recommended value: 1; mode=block
Largely superseded by Content-Security-Policy and harmless to send. Do not treat it as a substitute for CSP.
Cross-Origin-Opener-Policy5 points
Isolates your window from cross-origin windows that opened it or that you opened, so neither can hold a reference to the other and probe it.
Recommended value: same-origin
Needed for cross-origin isolation, which in turn is required for SharedArrayBuffer and high-resolution timers. Will break popup flows — OAuth, payment windows — that expect window.opener to work.
Cross-Origin-Embedder-Policy5 points
Requires every cross-origin resource the page loads to explicitly opt in, via CORP or CORS. Nothing loads by accident.
Recommended value: require-corp
The strictest of the three and the most likely to break an existing site — any third-party image, font, or script without the right headers will stop loading. Test on staging first.
Cross-Origin-Resource-Policy5 points
Declares which origins are allowed to embed this resource, mitigating side-channel attacks such as Spectre that read data across origins.
Recommended value: same-origin
Use cross-origin instead for assets you intend other sites to hotlink, such as a public CDN or an embeddable widget.
Copy-Paste Server Configuration
Both snippets set the eight headers worth sending on essentially every site. Cross-Origin-Embedder-Policy is deliberately left out — it is the one most likely to break third-party embeds, so add it only after testing. Run a scan afterwards to confirm your CDN or reverse proxy is not stripping what your origin sets.
Nginx
# Add to your server {} block
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;
add_header Cross-Origin-Opener-Policy "same-origin" always;
add_header Cross-Origin-Resource-Policy "same-origin" always;
# Stop leaking your stack
server_tokens off;
proxy_hide_header X-Powered-By;Apache
# Add to .htaccess or your <VirtualHost> block
<IfModule mod_headers.c>
Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'"
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "DENY"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()"
Header always set Cross-Origin-Opener-Policy "same-origin"
Header always set Cross-Origin-Resource-Policy "same-origin"
Header always unset X-Powered-By
Header always unset Server
</IfModule>
ServerTokens Prod
ServerSignature OffCheck Your Site's Security Headers
Security headers are instructions a server sends with every response telling the browser how to treat the page: which origins may run scripts on it, whether it may be framed by another site, whether it must be reached over HTTPS. They are cheap to add and they shut down entire classes of attack — but they only work if they are actually set, and most sites are missing several. Enter a URL above and this checker fetches the response, reports which of the ten headers below are present, grades the result out of 100, and shows the exact header value to add for anything missing. It also flags headers that are present but weakened, such as an HSTS max-age that is too short to be useful, or a Content-Security-Policy that still allows unsafe-inline.
Key Features
- Scans any public URL and reports the security headers it actually returns
- Grades the result A to F, weighted by how much each header matters
- Checks Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and the three Cross-Origin policies
- Flags weak values, not just missing ones — a short HSTS max-age or a CSP allowing unsafe-inline
- Warns when Server or X-Powered-By is leaking your stack to attackers
- Gives a recommended value for every header you are missing, ready to paste into your config
- Follows redirects and grades the page you actually land on
Common Use Cases
- Auditing a site before launch to catch missing headers while it is still cheap to fix
- Proving to a client or auditor that hardening was actually applied in production
- Checking that a CDN or reverse proxy is not stripping headers your origin sets
- Comparing staging against production to find configuration that never got promoted
- Working through a penetration-test finding about missing security headers
- Confirming a Content-Security-Policy survived a framework or hosting migration
Frequently Asked Questions
How do I check the security headers of a website?
Enter the site URL in the box above and run the scan. The checker requests the page, reads the response headers, and reports which security headers are present, which are missing, and which are present but weak. You get a grade out of 100 and a recommended value for anything you need to add.
Which security headers should a website have?
The core set is Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options (or CSP frame-ancestors), Referrer-Policy, and Permissions-Policy. Together they mitigate cross-site scripting, clickjacking, MIME sniffing, protocol downgrade, and referrer leakage. The three Cross-Origin policies matter if you need cross-origin isolation.
What does Strict-Transport-Security do?
HSTS tells the browser to only ever contact this site over HTTPS, for the duration given in max-age. It closes the window where a user typing an http:// address, or clicking an old link, could be intercepted before the redirect to HTTPS happens. A max-age below one year is generally considered too short to be effective.
What is a Content-Security-Policy header?
Content-Security-Policy restricts where a page may load scripts, styles, images, and frames from. It is the single most effective defence against cross-site scripting, because a script injected from an origin you did not approve is refused by the browser regardless of how it got onto the page. A policy that still permits unsafe-inline gives up much of that benefit, which is why this checker flags it.
Why did my site get a low grade?
The grade is weighted by impact, so missing Content-Security-Policy (20 points) or Strict-Transport-Security (15) costs far more than missing a Cross-Origin policy (5). A site serving no security headers at all scores zero and grades F. The missing-headers list shows the exact value to add for each one, so the grade is a to-do list rather than a verdict.