How it works
Enter a URL or bare domain and the analyser requests the page from our server, follows any redirects, and reads the HTTP response headers the site sends back. If you type a bare host, it is tried over https:// first. The result is a letter grade (A to F) with a score percentage, a per-header breakdown, and the full raw response for reference.
Read the output top to bottom. The grade box is a quick summary of how many critical protections are present, an F usually means no security headers at all; an A means the major browser-enforced defences are in place. The redirect chain shows every hop between what you typed and the final_url that was actually graded, which matters because headers on the final HTTPS response are the ones that count.
The Security Headers list is where you act. Each row carries a pass, warn or fail badge, the value the server sent (or not set), and a one-line summary. Work the fails first, then the warns. Information Leaks flags headers such as Server or X-Powered-By that disclose your stack and version to attackers, trim or remove them. Expand Raw response headers to see everything the server returned, useful for confirming a fix landed.
The key HTTP security headers
| Header | What it does | Typical value |
|---|---|---|
| Strict-Transport-Security | Forces browsers to use HTTPS for the domain after the first visit, blocking protocol-downgrade and cookie-stripping attacks. | max-age=31536000; includeSubDomains |
| Content-Security-Policy | Restricts which origins scripts, styles, images and frames may load from, the strongest defence against XSS and injection. | default-src 'self' |
| X-Frame-Options | Stops the page being embedded in a frame, preventing clickjacking. Now superseded by CSP frame-ancestors but still honoured by older browsers. | SAMEORIGIN |
| X-Content-Type-Options | Disables MIME-type sniffing, so the browser trusts the declared Content-Type instead of guessing. | nosniff |
| Referrer-Policy | Controls how much of the current URL is sent in the Referer header to other sites, limiting information leakage. | strict-origin-when-cross-origin |
| Permissions-Policy | Gates access to browser features such as camera, microphone and geolocation. Formerly named Feature-Policy. | geolocation=(), camera=() |
Frequently asked questions
Why did I get an F when my SSL certificate is fine?
This tool grades response headers, not the TLS certificate. A site can have a perfectly valid certificate and still send no security headers, which is exactly the gap that earns a low grade. Use the SSL checker for certificate and protocol health, and this tool for the header layer on top of it.
What is a good HSTS max-age?
A common production value is 31536000 seconds (one year), ideally with includeSubDomains. Add preload only once you are certain every subdomain can serve HTTPS, because preloading is hard to reverse quickly.
Do I still need X-Frame-Options if I have a CSP?
A CSP with frame-ancestors is the modern anti-clickjacking control and takes precedence in browsers that support it. Keeping X-Frame-Options: SAMEORIGIN as well costs nothing and covers older clients, so many sites send both.
Why does the tool follow redirects before grading?
Many sites redirect http:// or the apex domain to a canonical HTTPS URL. The headers that protect real users are the ones on that final response, so the analyser follows the chain and grades the destination while still showing you every hop.
Should I remove the Server header?
Detailed Server, X-Powered-By and X-AspNet-Version values tell attackers exactly what software and version you run, helping them target known vulnerabilities. Removing or genericising them is low-risk hardening, which is why the tool flags them as disclosures.