A security header checker with a score you can follow
This security header checker fetches a web page’s response headers and grades the ones that protect visitors: Content-Security-Policy, Strict-Transport-Security (HSTS), clickjacking protection with X-Frame-Options or frame-ancestors, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy and the flags on every cookie. It also checks that http:// redirects to HTTPS.
Every point is shown — there is no hidden formula — and each weakness comes with a reason and a fix. The missing headers are turned into lines you can paste into Nginx, Apache or a Cloudflare _headers file. For the policy itself, the CSP Generator builds and checks a Content-Security-Policy, and the Cookie Generator writes a safe Set-Cookie line.
How to use the Security Header Checker
- Enter your site’s address in Website address — a page people actually visit, not an error page.
- Press Scan headers. The page and its
http://version are fetched, and the grade appears with the score out of 100. - Read the scoring table: each row shows the points earned and what was found.
- Check Content-Security-Policy details, Other findings and the cookie table for specifics.
- Under Fixes to copy, choose Nginx, Apache or Cloudflare _headers, press Copy fixes, test on staging, deploy and scan again.
Security Header Checker features
Transparent 100-point score
Nine scored checks with fixed weights and a published grade scale; plain-HTTP pages are capped at F.
Real CSP analysis
Flags unsafe-inline without nonces, unsafe-eval, wildcard script sources, missing object-src and base-uri, and report-only policies; recognises nonce plus strict-dynamic.
Cookie flags for every cookie
Secure, HttpOnly and SameSite for each Set-Cookie on every redirect hop, with stricter rules for session-like cookies.
Copy-paste fixes
Only what is missing or weak, as add_header, Header always set or _headers lines, each with a one-line reason.
Leaks and obsolete headers
Version numbers in Server, X-Powered-By, an enabled X-XSS-Protection filter, Expect-CT and HPKP are reported without affecting the score.
How the score is calculated
Grades: A+ 95–100, A 85–94, B 70–84, C 55–69, D 40–54, F below 40. The weights are this tool’s own, chosen to reflect how much each header reduces real attacks; other scanners weigh things differently, so compare scores only within one tool.
| Check | Points | Full marks when |
|---|---|---|
| HTTP → HTTPS redirect | 5 | http:// redirects to https:// (or does not serve the page at all) |
| Content-Security-Policy | 25 | Enforced and restricts scripts; −10 unsafe-inline without nonce/hash, −5 unsafe-eval, −8 wildcard or scheme sources, −2 each for missing object-src 'none' and base-uri; report-only scores 5 |
| Strict-Transport-Security | 20 | max-age ≥ 1 year (16), includeSubDomains (+2), preload with both (+2) |
| Clickjacking protection | 10 | CSP frame-ancestors, or X-Frame-Options DENY or SAMEORIGIN |
| X-Content-Type-Options | 10 | nosniff |
| Referrer-Policy | 10 | no-referrer, same-origin, strict-origin or strict-origin-when-cross-origin (missing scores 5) |
| Permissions-Policy | 5 | Present |
| Cross-Origin-Opener-Policy | 5 | same-origin (4 for same-origin-allow-popups) |
| Cookie flags | 10 | Every cookie Secure and SameSite, session cookies HttpOnly (−4, −2, −3 per cookie) |
Worked example
A typical PHP site served with Server: Apache/2.4.41 (Ubuntu), a CSP of script-src * 'unsafe-inline' 'unsafe-eval', X-Frame-Options: ALLOW-FROM …, Referrer-Policy: unsafe-url, a PHPSESSID cookie without flags and no redirect from http:// scores 6 / 100 — F. The CSP keeps only its minimum 5 points, ALLOW-FROM is ignored by browsers so framing scores 0, and the cookie loses 9 of 10 points.
The fixes panel then lists six Nginx lines — HSTS, X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy and COOP — while the weak CSP is left to the CSP Generator, because a copied policy would break most sites. Adding those headers, flags on the cookie and a 301 from http:// lifts the same site to 78 (B); a nonce-based CSP then takes it to 98 (A+).
Limits of a header scan
Only HTTP response headers are read. A policy set in a <meta http-equiv> tag, cookies created by JavaScript and protections in the page code are not seen. The request comes from Cloudflare’s network without cookies, so logged-in pages, country-specific answers and bot protection can differ from what your visitors get. Values over 2,000 characters are shortened; each scan uses two of the 120 checks a network may make every 10 minutes. To see every header rather than just the security ones, use the HTTP Header Checker.
Security Header Checker FAQ
What are HTTP security headers?
Response headers that tell the browser to apply extra protection: only use HTTPS (HSTS), only run approved scripts (CSP), refuse to be framed by other sites, not guess file types, limit the Referer and restrict powerful features. They cost nothing and block whole classes of attacks.
How do I get an A+ on the security header checker?
Serve HTTPS with a 301 from http://, send HSTS for at least a year with includeSubDomains, add a CSP with nonces or hashes (no unsafe-inline), frame-ancestors or X-Frame-Options, nosniff, a strict Referrer-Policy, Permissions-Policy, COOP same-origin, and Secure, SameSite, HttpOnly cookies.
Will adding these headers break my site?
HSTS, nosniff, Referrer-Policy and X-Frame-Options rarely break anything. CSP and COOP can: start CSP in report-only mode and use same-origin-allow-popups if you rely on sign-in or payment pop-ups. Test on staging first.
Is X-XSS-Protection still needed?
No. Browsers removed the XSS filter, and enabling it in old browsers could create new problems. Send 0 or drop it, and rely on CSP.
Why is my grade different from another scanner’s?
Each scanner weighs headers differently. This one publishes its rubric above, so you can see exactly where every point comes from.
Does the security header checker store my results?
No. Only the URL and its http:// version are sent to the fetcher, which returns the headers; the grading happens in your browser and nothing is saved.