Security Headers Checker
Check the six HTTP security headers that matter and get a grade based on whether each one is really doing its job — not just whether it was sent. A complimentary tool from Squish — no signup.
Try , ,
What security headers actually do
Security headers are instructions your server sends alongside every page, telling the browser what to allow. HSTS refuses plain HTTP. Content-Security-Policy limits where scripts may load from. X-Frame-Options stops your page being loaded inside someone else's invisible frame. They cost nothing to set and they close whole categories of attack — but only when the value carries a real restriction, which is why this grades what each header does rather than whether it was sent.
Common questions
Which headers do you check?
Six, weighted by how much they matter: HSTS and Content-Security-Policy at 25 points each, X-Frame-Options and X-Content-Type-Options at 15, Referrer-Policy and Permissions-Policy at 10. That is 100 points, and the letter grade follows the score.
Why did I lose points on a header I have set?
Because a header that is present is not always a header that is working. content-security-policy: default-src * permits script from every host on the internet, and x-frame-options: ALLOWALL is a value no browser has honoured in years. Both are graded on what they do, so both take half credit rather than full.
I have no X-Frame-Options and still passed — why?
Your Content Security Policy carries frame-ancestors, which does the same job and supersedes X-Frame-Options in every browser that implements both. Setting the older header as well is harmless, but its absence is not a gap.
Does this tell me whether my site is secure?
No. It reads the headers on one response and grades those. It does not scan for malware, test your login, or look at your code. A good grade here means your headers are set well — nothing more, and we would rather say so than imply a clean bill of health we did not measure.
Headers are a server job, not a website job. They are set once in server configuration, which is the layer managed hosting exists to take off your hands.
See Squish hosting →