Skip to content
Get a Free Audit

HTTP header checker: security headers grade

Check a website’s HTTP response headers and get a security grade. See missing HSTS, CSP, nosniff and clickjacking protection, version leaks, compression, caching and cookie flags, with ready settings to fix them.

This tool needs JavaScript. Please turn it on, or open the page in a current browser.

How to use this tool

  1. Enter a link or paste headers Type your website link, or paste response headers from your browser.
  2. Click Check We read the headers and score the security ones.
  3. See your grade A is best. The grade counts security headers and version leaks.
  4. Read each line Green is good, yellow can improve, red is missing. Each line says why it matters.
  5. Copy the fix Use the Apache or Nginx example, test on a staging site, then go live.

Start with the easy ones

  • HSTS, nosniff, X-Frame-Options and Referrer-Policy are safe to add.
  • Hide server version numbers.
  • Turn on gzip or Brotli compression.

Be careful with CSP

  • A strict CSP can break scripts and ads.
  • Start with Content-Security-Policy-Report-Only.
  • Tighten step by step.

Hosting panels

  • On shared hosting, add headers in .htaccess.
  • Cloudflare can add headers with Transform Rules.
  • WordPress security plugins can set many of these.

Questions about this tool

Do security headers help SEO?

Not directly. They protect visitors; HTTPS and a safe site help trust.

Will HSTS break my site?

Only if some parts still need plain HTTP. Make sure the whole site works on HTTPS first.

Why does the link check show an example?

Fetching other websites needs our server, which goes live after launch. Paste mode works now.

What is a good grade?

A or B. Most small sites start at D or F and reach B in an hour.

Are pasted headers uploaded?

No. Paste mode runs fully in your browser.