Free · live registry data · no login

Security Headers Checker

HSTS, CSP and friends for your site.

How it works

Security headers checker: HSTS, CSP, X-Frame-Options and friends, graded

We fetch your site's home page from our server, follow redirects to the final URL and read every response header. Eight security headers are graded individually and combined into a 0 to 100 score: HSTS and Content-Security-Policy carry the most weight because they stop protocol downgrade and script injection; X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy and COOP follow. We also flag information leaks such as Server and X-Powered-By versions, and give you copy-paste header blocks for Nginx, Apache and Next.js.

Results appear here after you click Check headers.

How this works

1
Fetch the final page
Our server requests the URL, follows redirects, and captures the headers of the final response.
2
Grade eight headers
Each is scored against current best practice: presence, strictness and known-weak values such as unsafe-inline or short max-age.
3
Add leaks and cookies
Version-revealing Server headers and insecure cookie flags are flagged, and the total is turned into an A to F grade.

Frequently asked questions

What are HTTP security headers?: Response headers that tell the browser how to treat your site: force HTTPS (HSTS), which scripts may run (CSP), whether the page may be framed (X-Frame-Options), and so on. They are set in your web server or CDN config and cost nothing.
Which security header matters most?: Content-Security-Policy, because it blocks the damage from cross-site scripting, followed by Strict-Transport-Security, which prevents downgrade attacks. Together they are half of this tool's score. The rest are quick wins with little risk.
Will adding these headers break my site?: HSTS and nosniff almost never do. CSP can block inline scripts and third-party embeds, so start with Content-Security-Policy-Report-Only to see what would be blocked, then tighten the policy before enforcing it.
Why does X-XSS-Protection score as OK when missing?: The header is deprecated and modern browsers ignore it. In some older browsers it introduced vulnerabilities, so the current recommendation is to omit it or set it to 0 and rely on CSP instead.
I use Cloudflare or Vercel. Where do I set headers?: Cloudflare: Rules → Transform Rules → Modify Response Header, or enable HSTS under SSL/TLS. Vercel: the headers array in vercel.json or next.config.js. Netlify: a _headers file. All take effect in minutes.

Every MailShrine domain includes WHOIS privacy, transfer lock, Anycast DNS with DNSSEC and two business mailboxes.