Tools / Security Headers
Is your site telling browsers to protect its visitors?
HTTP security headers are the instructions a site gives the browser: only ever use HTTPS, only run scripts from here, never let another site frame this page. Enter a site and get the same A+ to F grade the well-known checkers give, with the reason for every mark and the line that fixes it.
HSTS · CSP · X-Frame-Options · X-Content-Type-Options · Referrer-Policy · Permissions-Policy · Cookies · COOP/COEP/CORPFree · No sign-up · PDF report
What it checks
The six that decide the grade
Strict-Transport-Security, Content-Security-Policy, X-Frame-Options (or CSP frame-ancestors), X-Content-Type-Options, Referrer-Policy and Permissions-Policy. All six present earns an A; an A+ needs them well set too.
Content Security Policy quality
default-src, script-src with 'unsafe-inline', 'unsafe-eval', wildcards or data:, broad CDN allow-lists, object-src, base-uri, frame-ancestors, and whether violations are reported.
HSTS detail
max-age length, includeSubDomains, preload readiness, and whether plain HTTP redirects to HTTPS or serves content.
Cookies
Every Set-Cookie on the page checked for Secure, HttpOnly and SameSite, with SameSite=None requiring Secure.
What the headers give away
Server and X-Powered-By versions, framework and cache headers that name products, and deprecated headers such as X-XSS-Protection, Expect-CT, Public-Key-Pins and P3P.
Cross-origin isolation
Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy, Cross-Origin-Resource-Policy and wildcard CORS on the page itself.
How the grade works
The letter follows the convention securityheaders.com established, so the two are comparable: each of the six headers present moves the grade up one step from F, all six earn an A, and an A+ needs them set well — an HSTS max-age of at least six months, a Content-Security-Policy that does not allow inline scripts, and nothing invalid. Headers that leak the server stack, deprecated headers and cookie flags are reported with a fix but do not move the letter, because they are advice rather than protection.
Every finding says what the header does, what happens without it and what to send. Most take one line in Apache, nginx or the application; Content-Security-Policy is the exception, and the report says where to start with it.
The check fetches the home page once with a browser-like request, follows redirects, and reads only the headers. It does not log in, submit forms or crawl. If you would like every public site you own checked on a schedule, with an analyst told when a header disappears after a deploy, that is part of the managed SOC.