How to use it

Type an address in Page URL, with or without https://, and press Check.
Read the grade and the Security headers score, then each row's State and What it does.
Scroll to All response headers for the complete list.
Press Copy as text to paste the headers into a ticket or a chat with your host.

How the score is calculated

Each header earns its points when Good, half when Weak, none when Missing. The weights are ours, based on MDN's descriptions of what each header protects against:

Header	Points	Good when	Weak when
`Strict-Transport-Security`	25	`max-age` of 180 days (15552000) or more	shorter max-age
`Content-Security-Policy`	25	present	contains `unsafe-inline`, `unsafe-eval` or `*`, without `strict-dynamic`
`X-Content-Type-Options`	15	`nosniff`	–
`Referrer-Policy`	15	any other value	`unsafe-url` or `no-referrer-when-downgrade`
`X-Frame-Options`	10	`DENY` or `SAMEORIGIN`, or CSP `frame-ancestors`	–
`Permissions-Policy`	10	present	–

On a plain-HTTP page, HSTS shows Needs HTTPS and the score is taken out of the other 75 points. Grades: A from 90, B from 75, C from 55, D from 35, E from 15, F below.

Copy-ready starting values

These are common, safe starting points (the CSP needs adapting to your site):

Strict-Transport-Security: max-age=31536000; includeSubDomains, only once HTTPS works on every subdomain.
X-Content-Type-Options: nosniff: browsers then refuse scripts and styles sent with the wrong type.
Referrer-Policy: strict-origin-when-cross-origin, the browsers' default: other sites get only your origin (scheme and domain), not the full address.
X-Frame-Options: SAMEORIGIN, or frame-ancestors 'self' in your CSP.
Permissions-Policy: camera=(), microphone=(), geolocation=(): () turns a feature off for the page and all its frames.
Content-Security-Policy: default-src 'self', then add each outside source your pages load. Test on a copy first: a strict policy blocks your own scripts too.

What the checker sees

It follows up to 10 redirects and grades the headers of the final page, fetched once from Cloudflare's network with a user agent naming this site. A CDN or bot protection can send us different headers than a browser gets, and only HTTP headers are read, not tags inside the HTML. Values the server sends twice are joined with commas.

Software versions in headers

If Server, X-Powered-By, X-AspNet-Version or X-AspNetMvc-Version contains a version number, the result warns that the server tells its exact software version. That tells anyone which security fixes the server may be missing. Most servers can send just the product name, or no header at all.

Questions

Why is X-Frame-Options Good when the header is missing?: Because a frame-ancestors directive in the Content-Security-Policy does the same job, and MDN recommends it for more options. The checker accepts either.
Why is my CSP marked Weak although it uses nonces?: The checker looks for unsafe-inline, unsafe-eval and * unless strict-dynamic is present. MDN notes that browsers ignore unsafe-inline when a nonce is present, so such a policy may be stronger than its state suggests.
Why does HSTS say Needs HTTPS?: The final page was served over plain HTTP. Browsers ignore HSTS sent over HTTP, so redirect to HTTPS first; the /redirect-checker shows that step.
Does grade A mean my site is secure?: No. It means six protective headers are set well. It says nothing about your software, passwords or server setup.
Why do my headers differ from what my browser's developer tools show?: We make one request from Cloudflare, without cookies, and some servers vary their answer by visitor, location or login.

Results come from public DNS, registry and certificate data and from checks run from Cloudflare's network at the moment you ask. They can differ from what another network sees. How our tools work · Terms of use.

HTTP headers checker