HTTP Security Headers Grader
Fetch a Uniform Resource Locator (URL) and grade its HyperText Transfer Protocol (HTTP) security headers — Content Security Policy (CSP), HTTP Strict Transport Security (HSTS), X-Frame-Options, Referrer-Policy, Permissions-Policy, and more.
Security headers break silently on deploy — nothing errors, they just stop being sent.
Monitor your security headers continuously
- ✓CSP / HSTS / X-Frame-Options tracking
- ✓Header change detection
- ✓Severity-ranked findings
- ✓Email + Slack + SMS alerts
- ✓Historical diff view
- ✓Full vulnerability scan add-on
Frequently Asked Questions
Which security headers does this tool grade?
The key headers checked: Content-Security-Policy (Cross-Site Scripting (XSS) mitigation), Strict-Transport-Security (HyperText Transfer Protocol Secure (HTTPS) enforcement), X-Frame-Options (clickjacking prevention), X-Content-Type-Options: nosniff (Multipurpose Internet Mail Extensions (MIME) sniffing), Referrer-Policy (controls Referer header leakage), and Permissions-Policy (restricts browser features like camera/microphone).
What is the most impactful header to add?
Content-Security-Policy is the most powerful but complex — it restricts which scripts, styles, and resources browsers can load, significantly reducing Cross-Site Scripting (XSS) impact. Start with Strict-Transport-Security (max-age=31536000; includeSubDomains) as it's easy to add and prevents protocol downgrade attacks.
What score would a typical site get?
Most sites score D or F on automated header graders — missing Content Security Policy (CSP) and Permissions-Policy is very common. An A grade requires all major headers including a non-trivial CSP. Even a B (HTTP Strict Transport Security (HSTS) + X-Frame-Options + nosniff + Referrer-Policy without CSP) significantly improves baseline security posture.