HTTP Security Headers Checker
Audit any URL's HTTP security headers — CSP, HSTS, X-Frame-Options, Referrer-Policy and more. Get an instant A+ to F grade with detailed findings and missing-header guidance.
🔒 The audit is performed by fetching the URL through a public CORS proxy. No credentials or cookies are sent with the request.
💡 Finding This Headers Checker Useful?
Get the standalone version — a single HTML file you can keep on your machine and open anytime, with no scripts loaded from anywhere.
🛒 Get the Standalone Version🔍 What Is an HTTP Security Headers Checker?
An HTTP Security Headers Checker analyzes the response headers a web server sends with every page load. These headers tell the browser how to behave in situations that could otherwise be exploited — whether to block inline scripts, whether to allow the page to be framed, whether to upgrade insecure requests, and more. This tool fetches the headers for a given URL, scores nine of the most important headers against current best practices, and returns a letter grade from A+ to F. It also explains what each missing header would prevent and how to set it.
✨ Key Features
Letter Grade A+ to F
A weighted score based on nine security headers, mapped to the same grading scale used by popular header scanners.
Nine Headers Audited
CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP, COEP, and CORP.
Per-Header Findings
Each header is shown with its actual value, a pass/warn/fail status, and a plain-English explanation.
Raw Header View
See the full set of response headers returned by the server in a collapsible panel.
Copy & Download
Copy a text summary or download the full audit as JSON for reports and handoffs.
Recent Audits
A short local history of your recent audits, stored only in your browser's localStorage.
📖 How to Use the Headers Checker
- Enter a URL — any public HTTPS or HTTP address, e.g.
https://example.com. - Click Check headers — the tool fetches the response headers through a public CORS proxy.
- Read the grade — an A+ to F letter grade with the weighted score out of 100.
- Review each header — see which headers pass, which are missing, and which are misconfigured.
- Check the summary — a short paragraph explains the most important findings.
- Copy or download — save the audit as text or JSON for your records.
🎯 Practical Use Cases
Security Audits
Quickly assess a site's header posture before a deeper penetration test.
Deployment Verification
Confirm that security headers are present after deploying a new version or changing servers.
Compliance Checks
Verify that a site meets internal or regulatory header requirements.
Learning Security
See which headers a well-configured site sends and what each one does.
Competitor Research
Compare header configurations across sites in your industry.
Fixing Configuration
Identify exactly which header to add and what value to use.
⚠️ Important Notes and Limitations
A few honest caveats about what this tool can and cannot do:
• The audit depends on a CORS proxy. Browsers cannot read response headers from arbitrary cross-origin requests. This tool routes the request through a public proxy to work around that. The proxy may be rate-limited or temporarily unavailable, and it may not follow every redirect chain the same way a direct browser request would.
• Headers can differ by path. A site may send different headers on / versus /api/ or /admin/. This tool audits the URL you provide, not every URL on the site.
• CSP grading is heuristic. A Content-Security-Policy is only as good as its directives. This tool flags common weaknesses like unsafe-inline and unsafe-eval, but a full CSP review requires reading every directive in context.
• HSTS only matters over HTTPS. If the URL uses plain HTTP, HSTS will not be present and cannot be — the header is only meaningful over a secure connection.
• A good grade is not a guarantee of security. Headers are one layer. They do not replace secure coding, authentication, input validation, or patching.
• This tool does not test for vulnerabilities. It only checks whether specific headers are present and configured in a way that matches common best practices.
❓ Frequently Asked Questions
Each of the nine headers is assigned a weight based on its security impact. Content-Security-Policy and Strict-Transport-Security carry the most weight. Each header is scored 0, 50, or 100 depending on whether it is missing, partially configured, or fully correct. The weighted scores are summed into a 0–100 total, which maps to a letter grade: A+ (95+), A (85–94), B (75–84), C (65–74), D (50–64), E (35–49), and F (below 35).
Browsers enforce the same-origin policy. JavaScript on this page cannot read response headers from a different domain — the browser blocks it for security reasons. To work around that limitation, the tool sends the URL to a public CORS proxy, which fetches the response and returns the headers with the necessary Access-Control-Allow-Origin header. The proxy only sees the URL you submit and the public response headers. No cookies, credentials, or private data are sent.
Nine headers: Content-Security-Policy (XSS mitigation), Strict-Transport-Security (HTTPS enforcement), X-Content-Type-Options (MIME sniffing prevention), X-Frame-Options (clickjacking prevention), Referrer-Policy (referrer leakage control), Permissions-Policy (browser feature restriction), Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy, and Cross-Origin-Resource-Policy (cross-origin isolation).
Different tools use different weighting schemes, different header sets, and different thresholds for what counts as a pass. This tool checks nine headers and weights them by impact. Securityheaders.com checks a similar but not identical set and may weight them differently. A difference of one letter grade between tools is normal. What matters is the specific findings — which headers are missing or misconfigured — not the exact letter.
No. This page has no backend. The audit is performed by your browser calling a public proxy directly. The "Recent audits" list is stored only in your browser's localStorage and is never transmitted. You can clear it by clicking Clear or by clearing your browser data.
Each finding includes a short note explaining what the header does and, where relevant, the value to use. In most cases you add headers at the web server, reverse proxy, or application framework level. For example, HSTS is typically set in Nginx or Apache configuration, while CSP is often set by the application framework (e.g., a middleware in Express, ASP.NET Core, or Django).
👨💻 About the Author — GenieDevs
📦 Get the Standalone Version
🛡️ HTTP Security Headers Checker – Standalone Edition
One self-contained HTML file with the full audit tool inside. Keep it on your machine, run it locally, or use it in an offline environment — the proxy calls still work from any modern browser.
✅ Final Takeaway
Security headers are one of the highest-leverage, lowest-effort improvements you can make to a web application. They are free, browser-enforced, and block entire classes of attacks — XSS, clickjacking, MIME sniffing, protocol downgrade. This tool tells you in seconds which ones your site is missing and what grade that translates to. Use it after every deployment, before every audit, or whenever you want a quick sanity check on a URL you do not control.