Security headers checker

A security header is an instruction a site sends with its response. The browser reads it before running the page. HSTS tells the browser to stay on HTTPS. Content-Security-Policy lists which scripts, frames, and objects are allowed. X-Frame-Options and frame-ancestors decide who may embed the page. X-Content-Type-Options: nosniff stops the browser from guessing a content type. Referrer-Policy limits the URL that leaks when someone clicks away. Permissions-Policy turns off camera, microphone, and location unless the page asks for them. COOP, COEP, and CORP control how this window and its files interact with other sites.

This check makes one GET to the URL you enter, on port 80 or 443, and follows at most five redirects. It reads those headers and then drops the body. It does not log in, submit a form, or try other ports. Before each request, including each redirect, the hostname is resolved and the check stops if any answer is a private, loopback, or reserved address.

How to read the grade

Grade A means the response has HSTS for at least a year with includeSubDomains, nosniff, framing locked down, a strict referrer policy, and an enforcing Content-Security-Policy that does not use unsafe-inline, unsafe-eval, or a star on the main directives. Grade B means the year-long HSTS, nosniff, and framing are in place, and something else is still loose, such as a missing CSP or a Server header's sibling X-Powered-By. Grade C means at least one of those three core controls exists and the set is incomplete. Grade D means only a side policy is set. Grade F means none of HSTS, nosniff, framing, or CSP showed up.

What each header is for

HSTS is only honored on HTTPS. A copy of the header on an HTTP response is ignored, which is why the result says so when the final URL is http. Preload eligibility, as far as this one response can show it, needs max-age of at least 31536000 seconds, includeSubDomains, and the preload token. The public preload list also wants the registrable domain, an HTTP-to-HTTPS redirect, and no leftover HTTP. This page can see the header. It cannot see the rest of that list's rules.

CSP is the header that actually stops an unexpected script. Report-Only is useful while you watch violations, and it blocks nothing. unsafe-inline and unsafe-eval put back much of the risk CSP exists to remove. A star in default-src or script-src means any host can supply that kind of content. Framing is covered either by X-Frame-Options DENY or SAMEORIGIN, or by CSP frame-ancestors without a star. ALLOW-FROM is obsolete. nosniff is a one-word header and it belongs on HTML, JSON, and downloads alike.

Referrer-Policy decides how much of the address travels with the next request. strict-origin-when-cross-origin, no-referrer, same-origin, and strict-origin keep the path at home. unsafe-url sends the path and query everywhere. Permissions-Policy is optional for a simple page and worth setting when you do not use the camera or location. COOP same-origin plus COEP require-corp turns on cross-origin isolation, which most marketing sites never need. CORP matters when other sites embed your files.

Common mistakes

• Sending HSTS only on www, or only over HTTP, and assuming the whole site is covered.
• Adding preload before every subdomain has a valid certificate. Removal from the preload list is slow.
• Leaving Content-Security-Policy-Report-Only in place and believing it enforces.
• Setting X-Frame-Options and also frame-ancestors *, then wondering which one won. frame-ancestors is the one modern browsers use.
• Publishing X-Powered-By with a framework version. The Server header is common; a version string is the part worth removing.

A missing header is a gap. A header with a star or unsafe-inline is a weaker instruction than it looks.