Security Header Checker – Free A-F Grading with Config Examples

What is Security Header Checker?

A free online tool that grades your website's HTTP security headers from A+ to F. Checks 7 key headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection) with pass/fail badges and Apache/Nginx configuration examples.

Key Features

How to Use

1. Enter the URL you want to check (e.g., https://example.com)
2. Click "Check"
3. Review the A-F grade and per-header results
4. Copy the recommended configuration for any missing headers

Security Header Glossary

Content-Security-Policy (CSP)

Controls which resources the browser can load. Mitigates XSS and data injection attacks. Uses directives like default-src, script-src, style-src.

Strict-Transport-Security (HSTS)

Forces HTTPS-only connections. max-age sets duration, includeSubDomains extends to subdomains, preload enables browser preload lists.

X-Frame-Options

Prevents clickjacking by controlling iframe embedding. Use DENY or SAMEORIGIN.

X-Content-Type-Options

Prevents MIME type sniffing. Only valid value: nosniff.

Referrer-Policy

Controls referrer information sent during navigation. Recommended: strict-origin-when-cross-origin.

Permissions-Policy

Controls browser API access (geolocation, camera, microphone). Formerly Feature-Policy.

X-XSS-Protection

Legacy XSS filter control. Modern best practice: set to 0 and use CSP instead.

How Security Headers Work

XSS Attacks

Attackers inject malicious scripts into web pages. CSP prevents loading unauthorized scripts.

Clickjacking

Attackers overlay transparent iframes over legitimate pages. X-Frame-Options prevents embedding.

MIME Sniffing

Browsers guess file types, potentially executing malicious files. X-Content-Type-Options: nosniff prevents this.

FAQ

Do security headers affect SEO?

HTTPS (related to HSTS) is a Google ranking signal. Security incidents can indirectly harm SEO.

Do I need all headers?

At minimum: CSP, HSTS, X-Frame-Options, and X-Content-Type-Options. The rest are strongly recommended.

CSP broke my site

Use Content-Security-Policy-Report-Only first, then check DevTools for errors and adjust.

Can I set headers on shared hosting?

Most hosts support .htaccess headers if mod_headers is enabled.