How to use the headers checker
- Enter the address of the page you want to inspect. The tool adds https:// if you leave it out.
- Press “Check headers”. Redirects are followed, and the headers shown are those of the final page.
- Read the grade, then open each security header to see its value, what it does and how to fix it.
- Scroll the full header table to inspect caching, compression, cookies and server details.
How the grade is calculated
Six headers are scored. Each earns 2 points when it is present with a safe value, 1 point when it is present but weak (or missing where browsers already apply a sensible default), and 0 points when it is missing or unsafe. The total out of 12 sets the letter: A for 11 or 12, B for 9 or 10, C for 7 or 8, D for 5 or 6, and F below that. A page served over plain HTTP cannot score better than D, because none of these protections hold when an attacker can rewrite the traffic.
Worked example
A typical CMS site sends Strict-Transport-Security: max-age=2592000 (30 days, so a warning worth 1 point), X-Frame-Options: SAMEORIGIN (2 points) and X-Content-Type-Options: nosniff (2 points). It has no Content-Security-Policy (0), and Referrer-Policy and Permissions-Policy are missing (1 point each). The total is 7 / 12, grade C. Raising HSTS to a year and adding the two missing low-risk headers lifts it to 10, a B, before anyone touches the harder CSP work.
The six headers and safe starting values
- Strict-Transport-Security: tells browsers to use HTTPS only. Start with
max-age=31536000; includeSubDomainsonce every subdomain supports HTTPS. - Content-Security-Policy: lists where scripts, styles and frames may come from, which limits the damage of an injected script. Begin with
default-src 'self'and add the hosts you really use. - X-Frame-Options:
SAMEORIGINstops other sites framing your pages for clickjacking. The CSP directiveframe-ancestorsdoes the same job and is accepted instead. - X-Content-Type-Options:
nosniffmakes browsers trust the declared file type. - Referrer-Policy:
strict-origin-when-cross-originshares only your domain, never full addresses, with other sites. - Permissions-Policy: switches off features you do not use, for example
camera=(), microphone=(), geolocation=().
Where to add them
On Netlify and Cloudflare Pages, put the headers in a _headers file. On Apache use Header always set in the server config or .htaccess; on Nginx use add_header … always. WordPress security plugins and CDN rules can also inject them. Test again after each change, because a cached copy at the CDN can hide a fix for a few minutes.
Reading the rest of the headers
The full table is useful beyond security. cache-control and age show whether a CDN is caching the page, content-encoding confirms gzip or Brotli compression, and vary explains why two visitors can receive different versions. Cookie values are hidden in the table, but their names and flags such as Secure, HttpOnly and SameSite stay visible, so you can still check that session cookies are protected.