Security Headers
Check the HTTP security headers of a public web page and see, for each one, what it does or what is missing.
Overview
The page is requested from this server, the way a browser would reach it: redirects are followed and the response that finally answers is judged. Headers can differ from page to page, so the address you enter matters. A login page is often configured differently from the home page.
The certificate and the TLS configuration are not part of this check. They belong to the SSL/TLS Server Test, and a page whose certificate browsers would not trust is not checked here.
Web interface
Enter a host name such as example.com or a full address such as
https://example.com/login. Without a scheme, HTTPS is used. The answer shows the grade, the
address that answered with its status, every redirect on the way, one row per header with a verdict and the
value that was sent, and all response headers as they arrived.
Deep links
The address can be put in the path, and the check starts when the page opens:
- /check/headers/troubleshooting.tools
/check/headers/https://example.com/login
Reading the grade
Six headers are graded: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options,
framing protection (frame-ancestors or X-Frame-Options), Referrer-Policy and Permissions-Policy.
A pass counts one point, a warning half a point, a missing or wrong header nothing.
| Points | Grade |
|---|---|
| 6, with Cross-Origin-Opener-Policy and no software version in the headers | A+ |
| 6 | A |
| 5 or more | B |
| 4 or more | C |
| 3 or more | D |
| 2 or more | E |
| less | F |
A page served over plain HTTP fails Strict-Transport-Security, since browsers ignore the header there.
What gets checked
| Header | Pass | Warning |
|---|---|---|
| Strict-Transport-Security | max-age of at least 180 days | a shorter max-age |
| Content-Security-Policy | scripts restricted to named sources, or by nonce, hash or 'strict-dynamic' | 'unsafe-inline' without a nonce or hash, 'unsafe-eval', a wildcard source, no script rule at all, or only a report-only policy |
| X-Content-Type-Options | nosniff | (any other value fails) |
| Framing | frame-ancestors, or X-Frame-Options DENY or SAMEORIGIN | X-Frame-Options with a value browsers ignore |
| Referrer-Policy | a value that sends at most the origin to other sites | missing, unsafe-url or no-referrer-when-downgrade |
| Permissions-Policy | present | missing |
Reported without weight: Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, a software version in
Server, X-Powered-By or the ASP.NET headers, cookies set without Secure, HttpOnly or SameSite, and an
X-XSS-Protection header other than 0, which browsers no longer support.
A Content-Security-Policy is checked for those common holes, not evaluated in full.
Limits
- Thirty checks per visitor in ten minutes, one at a time.
- Up to 5 redirects are followed, and a check takes at most 20 seconds.
- Only public host names on the standard ports, 443 for HTTPS and 80 for HTTP. IP addresses, other ports and names that resolve to a private address are refused, at every redirect too.
- Servers are reached over IPv4.
No public API
There is no public API for this tool. The check runs from the web interface only, and its endpoint serves only this page.
Privacy
The page is requested from this server through a VPN, so the checked site sees neither your address nor this server's. The body of the page is not read; only its headers are kept long enough to answer, and nothing is stored. The address you check is written to the access log like every lookup on this site.