Question 1

Which HTTP security headers does the checker test?

Accepted Answer

Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, Cross-Origin-Embedder-Policy, cookie flags, and information-leaking headers such as Server and X-Powered-By.

Question 2

How is the grade calculated?

Accepted Answer

Each header earns points weighted by its impact. Missing CSP or HSTS costs the most. Unsafe CSP directives and leaked version headers subtract points. A+ requires every core header present with a strict configuration.

Question 3

Does the checker scan my whole site?

Accepted Answer

No. It sends one GET request to the URL you enter, follows up to five redirects, and reads the response headers. It does not crawl, test inputs, or try to exploit anything. Run a Strix pentest for full coverage.

Header	Points	Full credit
Content-Security-Policy	25	No unsafe-inline, unsafe-eval, or wildcard script sources
Strict-Transport-Security	20	max-age of one year or more over HTTPS
X-Content-Type-Options	10	nosniff
X-Frame-Options or frame-ancestors	10	DENY, SAMEORIGIN, or a CSP frame-ancestors list
Referrer-Policy	10	strict-origin-when-cross-origin, no-referrer, same-origin, or strict-origin
Permissions-Policy	10	Present
Cross-Origin-Opener-Policy	5	same-origin
Cross-Origin-Resource-Policy	5	same-origin or same-site
Cross-Origin-Embedder-Policy	5	require-corp or credentialless
Server and X-Powered-By versions	−5 each	No version strings
Set-Cookie flags	−5 each	Secure, HttpOnly, and SameSite on every cookie

Security Headers Checker

How it works

Frequently asked questions

Start testing in minutes