Inspect response headers and grade the HTTP security configuration for any URL. One request - raw headers and an A‑F security score side by side.
Enter a URL to inspect headers and grade security
Security headers are HTTP response directives that tell the browser how to handle a page's content. They are one of the lowest-effort, highest-impact changes a site can make - no code changes, just server or CDN configuration. They defend against XSS, clickjacking, MIME-type confusion attacks, and information leakage.
Strict-Transport-Security (HSTS) forces browsers to always use HTTPS. Content-Security-Policy (CSP) is the primary XSS defence - declares which sources are trusted for scripts, styles, and other resources. X-Content-Type-Options: nosniff prevents MIME sniffing. X-Frame-Options controls iframe embedding to block clickjacking. Referrer-Policy limits how much URL data leaks in the Referer header. Permissions-Policy restricts browser feature access for the page.
HSTS and CSP are weighted at 25 points each - they block the most serious attack classes. X-Content-Type-Options and X-Frame-Options are 15 points each. Referrer-Policy is 10 points, Permissions-Policy 5 points, and COOP / COEP 2.5 points each. Partially-correct headers earn 40% of their weight. A+ requires all eight headers fully correct.
Headers are grouped by function. Security headers control browser protections. Cache / CDN headers show caching behaviour including Cloudflare-specific fields. Content headers describe the response body. Server headers reveal the origin software stack.
Sent to our server: URL and Method. We fetch files from that site. To answer a repeated check fast, we have to keep answers for 5 minutes; then they are deleted. Also added to the page link, so you can share the result: URL and Method.