Free Security Headers Checker With A+ to F Grade
Scan any website’s security headers and get a grade from A+ to F. See which headers are missing or weak, then copy ready-made fixes for Apache, Nginx and Cloudflare.
- What it doesGrades HTTP security headers A+ to F
- AccuracyExact headers, fixed scoring formula
- Works withAny public website
- PriceFree, no sign-up, no limit
- Last reviewed
What Is a Security Headers Checker?
Security headers are small instructions your server sends with every page. They tell browsers to always use HTTPS, block injected scripts, stop your site from being framed by others and limit what data is shared. They take minutes to add, cost nothing and block common attacks like clickjacking and cross-site scripting.
- Checks the 6 most important security headers
- Grades from A+ to F with a score out of 100
- Checks the HTTP to HTTPS redirect
- Fixes for Apache, Nginx and Cloudflare
- Free, no sign-up, no limits
How to Use the Security Headers Checker
Enter your website
See your grade
Review each header
Copy the fix
Add it and re-check
Add headers safely
- HSTS: only add it once your whole site works on HTTPS, including subdomains if you use includeSubDomains.
- CSP: start in Report-Only mode, check what it would block, then turn it on.
- Cloudflare: use Transform Rules to add response headers.
- WordPress: use our .htaccess Generator on Apache hosting.
Security Headers Explained
| Header | What it does | Good value |
|---|---|---|
| Strict-Transport-Security | Forces browsers to use HTTPS | max-age=31536000; includeSubDomains |
| Content-Security-Policy | Controls which scripts and files may load | A policy without unsafe-inline |
| X-Frame-Options | Stops other sites from framing your pages | SAMEORIGIN |
| X-Content-Type-Options | Stops browsers from guessing file types | nosniff |
| Referrer-Policy | Limits how much of your URL is shared | strict-origin-when-cross-origin |
| Permissions-Policy | Turns off browser features you do not use | camera=(), microphone=(), geolocation=() |
How the Security Headers Checker Works
- 01
Your site is requested
Our server requests your page over HTTPS and also over HTTP to check the redirect.
Our server - 02
Headers are read
The 6 security headers are read from the final response.
Our server - 03
Each header is rated
Each one gets full, partial or zero credit. For example, a CSP with unsafe-inline gets partial credit.
In your browser - 04
The score is added up
Credits are multiplied by each header's weight and added to a score out of 100.
In your browser - 05
A grade is given
The score becomes a letter grade, with fixes for every weak or missing header.
In your browser
The Scoring Formula
Score = sum of (header weight × credit), minus 10 if HTTP does not redirect to HTTPS. Credit is 1 for good, between 0 and 1 for weak, and 0 for missing.
| Header | Weight |
|---|---|
| Strict-Transport-Security | 25 |
| Content-Security-Policy | 25 |
| X-Frame-Options | 15 |
| X-Content-Type-Options | 15 |
| Referrer-Policy | 10 |
| Permissions-Policy | 10 |
Grades: A+ is 95 or more, A is 85+, B is 70+, C is 55+, D is 40+, and F is below 40.
Is the Security Headers Checker Accurate?
- Headers are read exactly as the server sends them
- Weak values, like unsafe-inline in CSP, get partial credit
- Missing headers are caught
- The HTTPS redirect check works
- Fix code is valid for Apache, Nginx and Cloudflare
Accuracy in plain words
The headers are exact. The grade is our opinion of how strong they are, based on common security guidance. Some sites, like those that must be shown in frames, may choose different values on purpose.
Features of the Security Headers Checker
A+ to F grade
A clear grade and a score out of 100.
6 key headers
HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
HTTPS redirect check
Makes sure HTTP visitors are sent to HTTPS.
Ready fixes
Copy code for Apache, Nginx and Cloudflare.
Plain words
Every header is explained without jargon.
Partial credit
Weak headers are spotted, not just missing ones.
Limitations of This Tool
- It does not scan for malware or hacked files
- It cannot add headers to your server for you
- It checks one URL at a time
- It cannot check pages behind a login
- Test HSTS and CSP on a staging site first
- Re-check after every server or CDN change
- Keep your CMS, plugins and server updated
- Check your SSL with our SSL Checker
Who Can Use This Security Headers Checker?
Developers
Check headers after a deploy and copy server-ready fixes.
Site admins
Find gaps in your server setup in seconds.
SEO specialists
Add a security check to every technical SEO audit.
Business owners
See how safe your site is, in a grade anyone understands.
Updates, Bug Fixes and Reviews
Security Headers Checker launched
First release with A+ to F grading, 6 security headers, HTTPS redirect check and fixes for Apache, Nginx and Cloudflare.
Full re-test and rules review
We run the tool against our test cases again and check MDN and OWASP security header guidance for changes.
Tool page last reviewed on .
Found a bug or a wrong result?
Tell us what you entered, what happened and what you expected. Our developer checks every report, fixes confirmed bugs as a high priority and tests the fix before it goes live.
Who Built and Reviewed This Tool
Hassan
Muhammad Ahtesham
Afza
Our standards
This page follows our Editorial Policy and Methodology. If something here is wrong, our Corrections Policy explains how we fix it. Learn more about the SpellMistake team.
Ratings From Real Users
Based on 2 real user ratings
Rate this tool
How useful was the Security Headers Checker for you?
Ratings come from real visitors. One rating per person. We never add, edit or remove ratings.
Security Headers Checker FAQ
What are security headers?
Security headers are HTTP response headers that tell browsers how to protect visitors, for example by forcing HTTPS or blocking scripts from unknown sources.
Is this security headers checker free?
Yes. It is 100% free, with no sign-up and no limits.
How do I get an A+ grade?
Add all 6 headers with strong values, avoid unsafe-inline in your CSP and make sure HTTP redirects to HTTPS.
Do security headers help SEO?
Not directly. But HTTPS is a ranking signal and a safe site builds trust with visitors. HSTS also makes sure visitors always use the secure version of your site.
How do I add security headers in WordPress?
On Apache hosting, add them to your .htaccess file. On Cloudflare, use Transform Rules. Some security plugins can also add them.
Is X-XSS-Protection still needed?
No. Modern browsers no longer use it. A strong Content Security Policy is the modern way to block injected scripts.
Can security headers break my site?
A strict Content Security Policy can block scripts your site needs. Test it in Report-Only mode first, then turn it on.