Security Headers Grader
Enter any URL and instantly grade its HTTP security headers — CSP, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy, and more.
Headers we check:
Content-Security-PolicyPrevents XSS and data injection.
Strict-Transport-SecurityForces HTTPS and prevents downgrade attacks.
X-Frame-OptionsPrevents clickjacking via iframes.
X-Content-Type-OptionsPrevents MIME sniffing attacks.
Referrer-PolicyControls referrer header leakage.
Permissions-PolicyControls browser API access.
Cross-Origin-Opener-PolicyIsolates your page from cross-origin attacks.
What Are HTTP Security Headers?
HTTP security headers are directives sent by your web server with each response that instruct the browser how to behave for security purposes. Each header is a critical line of defence against a specific category of web attack. Missing headers leave users of your site exposed to attacks like XSS, clickjacking, MIME sniffing, and protocol downgrade attacks.
The Most Important Security Headers
- Content-Security-Policy — The most powerful header for preventing XSS. See MDN's CSP guide ↗.
- Strict-Transport-Security (HSTS) — Prevents protocol downgrade attacks and cookie hijacking. See the MDN HSTS reference ↗.
- X-Frame-Options — Prevents your page from being embedded in iframes on attacker-controlled sites (clickjacking). Now superseded by
frame-ancestorsin CSP. - X-Content-Type-Options: nosniff — Stops the browser guessing a file's content type, which prevents MIME confusion attacks.
- Referrer-Policy — Controls how much URL information is leaked in the
Refererheader when navigating between pages. - Permissions-Policy — Restricts access to sensitive browser APIs (camera, microphone, geolocation) on a per-origin basis.
The OWASP Secure Headers Project ↗ maintains a comprehensive reference and best-practice values for all HTTP security headers. Scott Helme's securityheaders.com ↗ is the most widely-referenced independent grader in the security community. Mozilla's HTTP Observatory ↗ provides a similar service with detailed explanations.