Security Headers Checker
Check a live site's security-related HTTP headers, with a letter grade.
This is one of three tools on this site that need a server-side connection: browsers block cross-origin header inspection of arbitrary sites via CORS, so a server has to fetch the page and relay its headers back. The URL you enter is used only to make that one request and is not logged or stored.
- Real fetch of the live site, with redirects followed safely.
- Letter grade plus a per-header pass/fail, not just a raw header dump.
- Explains what each header actually does, not just whether it's present.
Overview
Fetches a live URL and grades the security-related response headers it sends — CSP, HSTS, X-Frame-Options, Permissions-Policy and more — with a letter grade and a plain-English explanation of each.
How to use it
- 1Enter a URL.
- 2Click Check.
- 3Review the grade and the per-header breakdown.
Frequently asked questions
What people use it for
Audit a site's security headers before a launchConfirm CSP, HSTS and the other key headers are actually being sent in production.
Check headers after a CDN or reverse-proxy changeConfirm a new edge configuration didn't silently drop a security header.
Compare your site against a competitor'sSee which headers they send that you don't.
Related tools
All security toolsCSP AnalyzerParse a CSP header and flag common weaknesses, including missing frame-ancestors and object-src.HTTP Headers AnalyzerParse and explain raw HTTP response headers.Password Strength CheckerCheck a password's strength and estimated crack time.HMAC GeneratorGenerate an HMAC signature for a message with a secret key.
Ready to use Security Headers Checker?
Security Headers Checker