Security Headers Check
Fetches a page and grades the response headers that tell browsers how to protect it — HSTS, CSP, framing, MIME sniffing and the rest.
About
Several response headers tell a browser how to behave with a page: to insist on HTTPS, to restrict where scripts come from, to refuse framing and to limit what is sent in a referrer. This tool fetches a URL and grades those headers, explaining what each one buys you.
How to use
- Enter the URL of the page, including https://.
- Submit to fetch the response headers.
- Work down the list, starting with the failures rather than the warnings.
Frequently asked questions
Which header matters most?
HSTS, because it closes the window where a first request can be intercepted over plain HTTP. A long max-age with includeSubDomains is the usual target.
Is a weak CSP worse than none?
Not worse, but a policy full of unsafe-inline gives much less protection than it appears to. It is worth tightening the policy once the site works with it in report-only mode.
Why check the final URL instead of the one I typed?
Headers are set per response. A redirect often has different headers from the page behind it, and it is the page that runs in the browser.