HTTP Security Headers Checker

What are HTTP security headers?

HTTP security headers are response headers a web server sends to instruct the browser how to behave more safely - which scripts to run, whether the page may be framed, and whether to stay on HTTPS. They turn defence-in-depth on at the browser level, blocking whole classes of attack (XSS, clickjacking, protocol downgrade, MIME sniffing) without changing your application code.

What is a good security headers grade?

A good grade is A or A+. An A+ means every key header is present and correctly configured: HSTS with a one-year max-age, a Content-Security-Policy without unsafe-inline/unsafe-eval, X-Content-Type-Options: nosniff, clickjacking protection, a strict Referrer-Policy and a Permissions-Policy. A, B and C mean progressively more headers are missing or weakened; D and F mean most are absent.

Which headers does this tool grade?

• Strict-Transport-Security (HSTS) - RFC 6797. Forces browsers onto HTTPS for a set max-age and blocks protocol-downgrade and cookie-hijacking attacks. Aim for max-age=63072000; includeSubDomains; preload.
• Content-Security-Policy (CSP) - W3C CSP Level 3. Whitelists the sources of scripts, styles and frames the browser may load; the single strongest mitigation for cross-site scripting (XSS). Avoid 'unsafe-inline' and 'unsafe-eval'.
• X-Content-Type-Options - must be nosniff so the browser does not reinterpret a response as an executable MIME type.
• X-Frame-Options / frame-ancestors - RFC 7034. Stops other sites from framing yours (clickjacking). SAMEORIGIN or a CSP frame-ancestors directive both satisfy this; frame-ancestors is the modern replacement.
• Referrer-Policy - W3C Referrer Policy. Controls how much of your URL is leaked in the Referer header. strict-origin-when-cross-origin is a sensible default.
• Permissions-Policy - W3C Permissions Policy, which replaces the deprecated Feature-Policy. Disables powerful browser features (camera, microphone, geolocation) you do not use.

What does the R grade mean?

R is shown when the URL you entered redirects to a different host. Grading the redirect target's headers under the original address would be misleading, so we report R and ask you to re-scan the final URL directly. This matches the convention used by securityheaders.com (there is no E grade).

How is the grade calculated?

Each header carries a weight by impact: CSP 25, HSTS 20, clickjacking protection 15, Referrer-Policy 15, Permissions-Policy 15 and X-Content-Type-Options 10, for 100 points. A header that is present but weak earns partial credit. A+ is reserved for a clean sheet - every header present and correctly set. Information-disclosure headers (Server, X-Powered-By) are flagged as advisories but do not change the score.

Is this an open proxy?

No. The scanner fetches only the single public URL you type, through an SSRF-safe client that refuses private, internal, loopback and cloud-metadata addresses and revalidates every redirect hop. It reads response headers only - it never returns page content - so it cannot be used to relay arbitrary requests.