Security headers checker
Security headers are short instructions your website sends to browsers, telling them how to protect your visitors. Enter a domain to test its headers (HSTS, Content-Security-Policy, framing protection and more) and get a grade with a copy-paste fix for each gap.
What this checks
- One request to the homepage - the same as a browser visit - starting at http:// to see the redirect to HTTPS.
- Headers only: the page content is not read, and nothing is tested or attacked.
- A grade from A+ to F with the exact value seen, why each header matters and how to fix it on Apache, nginx or Cloudflare.
- Not a full assessment: no malware, exposed-file or vulnerability checks. Results are not saved.
What each security header does
Strict-Transport-Security (HSTS)
Once a browser has seen it, the browser uses HTTPS for the site for max-age seconds, even when someone types http:// or follows an old link. Use a max-age of at least one year (31536000). Add includeSubDomains when every subdomain has HTTPS. The preload directive asks browsers to ship your domain in their built-in HTTPS-only list; read the hstspreload.org requirements first, because leaving the list takes months.
Content-Security-Policy (CSP)
Lists where scripts, styles, images, frames and other resources may come from. A good policy stops most injected scripts from running, which makes cross-site scripting (XSS) far less damaging. 'unsafe-inline' and 'unsafe-eval' in script-src, and wildcards such as * or https:, remove most of that protection. Roll a policy out as Content-Security-Policy-Report-Only first, then enforce it.
X-Content-Type-Options
The single value nosniff stops browsers from guessing a file type from its content, so an uploaded text or image file cannot be run as a script or stylesheet.
X-Frame-Options and frame-ancestors
Decide which sites may display your pages in a frame. Without them, another site can load your page invisibly and trick visitors into clicking buttons on it (clickjacking). The CSP directive frame-ancestors 'self' is the modern control; X-Frame-Options: SAMEORIGIN covers older browsers.
Referrer-Policy
Controls how much of the current address is sent to other sites when a visitor follows a link or a page loads a third-party resource. strict-origin-when-cross-origin sends only your domain to other sites, so private paths, search terms and tokens in URLs stay private.
Permissions-Policy
Turns off browser features your site does not use, such as the camera, microphone or location. If an attacker or a third-party script gets code onto the page, it cannot ask for those features.
Cross-Origin-Opener-Policy (COOP)
same-origin puts your page in its own browsing context group, so windows from other sites that open it (or that it opens) cannot keep a handle to it. That blocks a class of cross-window attacks and data leaks. Sites that open sign-in or payment pop-ups usually need same-origin-allow-popups.
Cross-Origin-Resource-Policy (CORP)
Tells browsers whether other sites may load this response. same-origin or same-site stops your pages and private files from being pulled into another site, which limits Spectre-style side-channel leaks. Public files on a CDN can use cross-origin.
Leaking headers: Server, X-Powered-By, X-AspNet-Version
Headers such as Server: Apache/2.4.41 or X-Powered-By: PHP/7.4.3 tell anyone exactly which software versions you run, which makes finding a matching known vulnerability easy. Removing them does not patch anything - keep software updated - but there is no reason to advertise it. The checker deducts points only when a version number or X-Powered-By is shown.
Frequently asked
Is this a full security scan?
No. The checker loads one homepage and looks only at its HTTP response headers. It does not look for malware, exposed files, outdated software or vulnerabilities, and a good grade does not mean a site is secure. Webforta Scan covers those checks for websites you verify.
What exactly does the checker request?
One GET request for the homepage, starting at http:// so it can see whether the site redirects to HTTPS, and following up to four redirects that stay on the same domain (or its www / non-www twin). Only when plain HTTP does not end on HTTPS is the https:// homepage loaded as well. The response body is not read. Private, internal and reserved addresses are refused, and every redirect is checked again before it is followed.
Are results stored?
Results are not saved to a database or tied to an account. A finished result is kept for about 10 minutes in a short-lived cache so the share link works, and then discarded. A per-network counter is kept to enforce the hourly limit on free checks.
How is the grade calculated?
Up to 100 points across eight headers: Strict-Transport-Security and Content-Security-Policy are worth 25 each; X-Content-Type-Options, framing protection, Referrer-Policy and Permissions-Policy 10 each; Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy 5 each. Version-leaking headers cost up to 10 points. Without an enforced CSP or HSTS the grade cannot go above B, and a site that does not end on HTTPS cannot go above D. A+ needs 95 points, full marks on the four core headers and no leaks.
Why is my grade different from another tool?
Every checker weighs headers differently. The rules used here are listed above and applied the same way to every site, so you can compare before and after a change.
Can I check a specific page instead of the homepage?
Not with this tool: only the host name is used. Headers can differ between pages, so check important pages (such as login or checkout) in your browser developer tools, or run a Webforta Scan.
Does a CSP in an HTML meta tag count?
No. The checker reads HTTP headers only. A meta tag policy works for most directives, but it cannot set frame-ancestors or reporting, so a header is the better place for it.
My site is behind Cloudflare. How do I add these headers?
Use a Response Header Transform Rule (Rules > Transform Rules) to set or remove headers at the edge; each fix below includes the wording for one. Cloudflare can also enable HSTS under SSL/TLS > Edge Certificates.
Webforta Scan checks 40+ things and can re-check them on a schedule
Headers are one part of the picture. A Webforta scan of a website you verify also checks HTTPS and certificates, cookies, exposed files, version leaks and mixed content, with evidence and a fix for every finding - and tells you when something changes.