Security Headers Checker

{ "status": "ok", "final_url": "https://www.example.com/", "http_to_https_redirect": true, "grade": "C", "headers": { "strict-transport-security": { "present": true, "ok": true }, "content-security-policy": { "present": false, "ok": false } } }

What are HTTP security headers?

HTTP security headers are instructions a web server sends with each page that tell the browser to switch on built-in protections: always use HTTPS, refuse to be embedded in another site, only run scripts from approved sources. They cost nothing to add and block whole classes of attack.

The headers this tool checks

Header	What it does	Weight
`Strict-Transport-Security`	Forces browsers to use HTTPS for every future visit (HSTS).	25
`Content-Security-Policy`	Limits where scripts, styles and frames may load from. The main defense against cross-site scripting.	25
`X-Frame-Options`	Stops other sites framing your pages (clickjacking). A CSP `frame-ancestors` directive counts too.	15
`X-Content-Type-Options`	`nosniff` stops browsers guessing a file's type and running it as script.	15
`Referrer-Policy`	Controls how much of your URL is passed to other sites.	10
`Permissions-Policy`	Switches off browser features the site does not use, such as camera or geolocation.	10

The grade is the total: A is 90 or more, B 75, C 55, D 35, and F below that. A site that does not serve HTTPS at all is capped at F.

The tool also reports two things that do not affect the grade: whether plain HTTP redirects to HTTPS, and whether the Server or X-Powered-By headers reveal software versions.

How to read the results

HSTS with a short max-age gets partial credit. Six months (15552000 seconds) is the minimum that counts; one year is the usual target.
A CSP that allows 'unsafe-inline' scripts without a nonce or hash is noted, because inline script is exactly what an injection attack uses.
A Report-Only CSP is reported as not enforced. It collects violations but blocks nothing.
X-XSS-Protection is not graded. Modern browsers removed the feature it controlled, and setting it can introduce problems of its own.

The check makes one request to the site's home page, follows up to five redirects and reads only the response headers. It identifies itself as NetworkAIBot. Other pages on the same site may send different headers.

How to add the missing headers

After a scan, the result shows ready-made configuration for exactly the headers your site lacks. The general pattern on each platform:

Nginx

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

Apache

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "DENY"
Header always set Referrer-Policy "strict-origin-when-cross-origin"

Four of the six are safe to add to almost any site in one step. Two need care:

HSTS is hard to undo. Once a browser has seen it, it refuses plain HTTP for the whole max-age. Confirm every subdomain works over HTTPS before adding includeSubDomains, and start with a short max-age.
Content-Security-Policy can break a site, because it blocks any script or style it does not explicitly allow. Deploy it first as Content-Security-Policy-Report-Only, fix what it reports, then enforce it.

In Nginx, an add_header inside a location block replaces the ones set at server level instead of adding to them. If a header disappears on some paths, that is usually why.

What a good header set looks like

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()

This is a strict baseline for a site that loads everything from its own origin. Most real sites need extra CSP sources for analytics, fonts or a CDN. HSTS is specified in RFC 6797, and the OWASP Secure Headers Project keeps current guidance on each header.

Preguntas frecuentes

Which security headers are most important?

Strict-Transport-Security and Content-Security-Policy do the most. HSTS removes the chance of a visitor being downgraded to plain HTTP, and a well-built CSP stops most cross-site scripting. X-Content-Type-Options: nosniff is the easiest win — one line, no side effects.

Is X-Frame-Options still needed if I have a Content-Security-Policy?

Not if the CSP includes a frame-ancestors directive, which replaces it in all current browsers. This checker accepts either. Many sites send both, which is harmless, and keeps very old browsers covered.

What max-age should HSTS use?

One year (31536000 seconds) is the standard value, and the minimum required for the browser preload list. Start lower — a day, then a week — while you confirm nothing on the domain still depends on plain HTTP, then raise it.

Will adding security headers break my website?

X-Content-Type-Options, Referrer-Policy and Permissions-Policy almost never do. X-Frame-Options breaks the site only if you intentionally embed it elsewhere. Content-Security-Policy is the one that needs testing, which is why it should start in Report-Only mode.

Do security headers affect SEO?

Not directly. Search engines do not rank on these headers. HTTPS itself is a ranking signal, and the headers reduce the risk of a compromise that would get a site flagged as unsafe — which does remove it from search results.

Why did my grade drop when nothing changed?

Headers are often added by a CDN, proxy or framework rather than the application. A changed proxy rule, a new deploy target or a different response path — such as a redirect to a login page — can return a different set. Check the final URL shown in the result.

What are HTTP security headers?

The headers this tool checks

Header	What it does	Weight
`Strict-Transport-Security`	Forces browsers to use HTTPS for every future visit (HSTS).	25
`Content-Security-Policy`	Limits where scripts, styles and frames may load from. The main defense against cross-site scripting.	25
`X-Frame-Options`	Stops other sites framing your pages (clickjacking). A CSP `frame-ancestors` directive counts too.	15
`X-Content-Type-Options`	`nosniff` stops browsers guessing a file's type and running it as script.	15
`Referrer-Policy`	Controls how much of your URL is passed to other sites.	10
`Permissions-Policy`	Switches off browser features the site does not use, such as camera or geolocation.	10

The grade is the total: A is 90 or more, B 75, C 55, D 35, and F below that. A site that does not serve HTTPS at all is capped at F.

The tool also reports two things that do not affect the grade: whether plain HTTP redirects to HTTPS, and whether the Server or X-Powered-By headers reveal software versions.

How to read the results

HSTS with a short max-age gets partial credit. Six months (15552000 seconds) is the minimum that counts; one year is the usual target.
A CSP that allows 'unsafe-inline' scripts without a nonce or hash is noted, because inline script is exactly what an injection attack uses.
A Report-Only CSP is reported as not enforced. It collects violations but blocks nothing.
X-XSS-Protection is not graded. Modern browsers removed the feature it controlled, and setting it can introduce problems of its own.

How to add the missing headers

After a scan, the result shows ready-made configuration for exactly the headers your site lacks. The general pattern on each platform:

Nginx

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

Apache

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "DENY"
Header always set Referrer-Policy "strict-origin-when-cross-origin"

Four of the six are safe to add to almost any site in one step. Two need care:

HSTS is hard to undo. Once a browser has seen it, it refuses plain HTTP for the whole max-age. Confirm every subdomain works over HTTPS before adding includeSubDomains, and start with a short max-age.
Content-Security-Policy can break a site, because it blocks any script or style it does not explicitly allow. Deploy it first as Content-Security-Policy-Report-Only, fix what it reports, then enforce it.

In Nginx, an add_header inside a location block replaces the ones set at server level instead of adding to them. If a header disappears on some paths, that is usually why.

What a good header set looks like

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()

Obtén esto como API

What are HTTP security headers?

The headers this tool checks

How to read the results

How to add the missing headers

What a good header set looks like

Preguntas frecuentes

Which security headers are most important?

Is X-Frame-Options still needed if I have a Content-Security-Policy?

What max-age should HSTS use?

Will adding security headers break my website?

Do security headers affect SEO?

Why did my grade drop when nothing changed?

Herramientas relacionadas

Comprobador de certificados SSL

Comprobador de TLS poscuántico

Chequeo de salud del dominio

Comprobador de registros CAA

Consulta DNS

Security Headers Checker

Obtén esto como API

What are HTTP security headers?

The headers this tool checks

How to read the results

How to add the missing headers

What a good header set looks like

Preguntas frecuentes

Which security headers are most important?

Is X-Frame-Options still needed if I have a Content-Security-Policy?

What max-age should HSTS use?

Will adding security headers break my website?

Do security headers affect SEO?

Why did my grade drop when nothing changed?

Herramientas relacionadas

Comprobador de certificados SSL

Comprobador de TLS poscuántico

Chequeo de salud del dominio

Comprobador de registros CAA

Consulta DNS