Security Headers Checker
Fetch a site and grade its HTTP security headers from A to F, with a fix for every missing one.
FAQ
How is the grade calculated?
Each key header (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) contributes to a 0-100 score mapped to A-F.
Why did my grade drop after adding a CDN?
Some CDNs/WAFs strip or add headers; grade the final URL your users actually reach.
Is CSP required for an A?
CSP carries the most weight - it's hard to reach an A without a Content-Security-Policy.
About security headers
HTTP response headers tell the browser how to behave more safely - enforcing HTTPS, blocking framing, and restricting scripts. We fetch the page directly and grade what the server sends; nothing is sent to a third party.
Add missing headers at your web server, framework, or CDN edge, then re-check.