Grade a website's HTTP security headers and get the exact header to add for each missing protection.
🎁 Your first website check is free – every security tool works on it. Need unlimited checks? Go Pro
🔒 We load the homepage once, like a normal visitor, and read the response headers.
How to use the security headers checker
- Enter a domain.
- We load its homepage and read the response headers.
- Fix anything marked with a cross using the suggested header.
What are security headers?
Instructions a website sends to the browser, like 'only ever use HTTPS' or 'don't let other sites frame this page'. They cost nothing and block whole classes of attacks.
Where do I add them?
In your web server config (Apache .htaccess, Nginx), your CDN (Cloudflare Transform Rules) or a security plugin on WordPress.
Frequently asked questions
What is a good security headers grade?
A or A+. Most small business sites score D or F because nothing is configured.
Will adding headers break my site?
HSTS, X-Content-Type-Options, X-Frame-Options and Referrer-Policy are safe for almost every site. Content-Security-Policy needs testing – start in report-only mode.
Does this scan my site for vulnerabilities?
No. It only reads the headers of one normal page load.