Skip to content
Webmaster Tools
SecuritySecurity Headers

Security Headers Checker

Grade the response headers.

Redirects are followed; the headers of the final response are graded.

About the Security Headers Checker

This tool requests a URL, follows redirects, and grades the security headers on the final response. Each header is weighted by how much protection it adds: Content-Security-Policy 25, Strict-Transport-Security 20, X-Frame-Options (or CSP frame-ancestors) 15, X-Content-Type-Options, Referrer-Policy and Permissions-Policy 10 each, and Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy and Cross-Origin-Embedder-Policy 5 each. A pass earns the full weight and a warning half. The total becomes a score out of 100 and a grade: A from 90, B from 75, C from 60, D from 40, otherwise F.

It looks at the values, not just presence: an HSTS max-age under 180 days, a CSP weakened by 'unsafe-inline' or 'unsafe-eval', a Report-Only policy, or a referrer policy that leaks full URLs all count as warnings. Headers that reveal server software (Server, X-Powered-By and similar) are listed separately and not scored. Most failing or weak headers come with a recommended fix, usually a header value you can copy.

How to use it

  1. Enter a URL or domain.
  2. Select Check headers.
  3. Filter by Fail or Warn and open Show fix to see the recommended header.

Examples

Common questions

Is X-XSS-Protection still needed?

No. Modern browsers have removed the XSS auditor it controlled, so it isn't graded here. A good Content-Security-Policy is the real defense.

Should I add preload to HSTS?

Only when every subdomain works over HTTPS. Preloading hard-codes HTTPS for your domain in browsers, and removal from the list is slow.

Do I need both X-Frame-Options and frame-ancestors?

CSP frame-ancestors supersedes X-Frame-Options in modern browsers, and either passes this check. Sending both covers older browsers.