Which HTTP security headers does the checker test?

Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, Cross-Origin-Embedder-Policy, cookie flags, and information-leaking headers such as Server and X-Powered-By.

How is the grade calculated?

Each header earns points weighted by its impact. Missing CSP or HSTS costs the most. Unsafe CSP directives and leaked version headers subtract points. A+ requires every core header present with a strict configuration.

Does the checker scan my whole site?

No. It sends one GET request to the URL you enter, follows up to five redirects, and reads the response headers. It does not crawl, test inputs, or try to exploit anything. Run a Strix pentest for full coverage.

Scanners

Security Headers Checker

Free security headers checker. Scan any URL for CSP, HSTS, X-Frame-Options, and more. Get an A+ to F grade, missing-header fixes, and an embeddable badge.

How the grade works

The checker sends one GET request to the URL, follows up to five redirects, and reads the response headers of the final page. Each header earns points based on presence and on the strength of its value. Information leaks and insecure cookies subtract points.

Header	Points	Full credit
Content-Security-Policy	25	No unsafe-inline, unsafe-eval, or wildcard script sources
Strict-Transport-Security	20	max-age of one year or more over HTTPS
X-Content-Type-Options	10	nosniff
X-Frame-Options or frame-ancestors	10	DENY, SAMEORIGIN, or a CSP frame-ancestors list
Referrer-Policy	10	strict-origin-when-cross-origin, no-referrer, same-origin, or strict-origin
Permissions-Policy	10	Present
Cross-Origin-Opener-Policy	5	same-origin
Cross-Origin-Resource-Policy	5	same-origin or same-site
Cross-Origin-Embedder-Policy	5	require-corp or credentialless
Server and X-Powered-By versions	−5 each	No version strings
Set-Cookie flags	−5 each	Secure, HttpOnly, and SameSite on every cookie

Grades: A+ at 95 or more, A at 85, B at 70, C at 55, D at 40, E at 20, F below 20.

Why headers matter

Security headers are instructions from your server to the browser. They cannot fix a vulnerable application, but they turn many exploitable bugs into dead ends. A strict CSP stops an injected script from running. HSTS stops downgrade attacks. Frame protection stops clickjacking. Each header takes minutes to add and removes an entire class of attack from the table.

What this tool does not do

It does not crawl. Only the URL you enter and its redirects are requested.
It does not send payloads or test for vulnerabilities in the application.
It does not scan private, internal, or loopback addresses.
It does not evaluate TLS configuration, certificates, or DNS records.

For the application layer, run an autonomous pentest with Strix. Related reading: the JWT analyzer for token security, and the CVE Database to check the software versions your Server header reveals.

Frequently asked questions

More free tools

Start testing in minutes

Connect your GitHub repos and domains, and get fully set up in a few clicks.

Start for free All free tools →