--- title: Free Security Headers Checker description: Grade the HTTP security headers a URL sends, A+ to F — Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and cookie flags — with the reason behind every point lost and the nginx, Apache, Caddy or Cloudflare config that fixes it. The same request a browser makes, from a real probe location. canonical: https://watchfor.io/security-headers-checker --- [Back to all free tools](/free-tools) # Security Headers Checker Grade the HTTP security headers a URL sends, A+ to F — Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and cookie flags — with the reason behind every point lost and the nginx, Apache, Caddy or Cloudflare config that fixes it. The same request a browser makes, from a real probe location. [How to use this tool](/blog/how-to-check-security-headers) Result No result yet Fill in the form above and run it — the result appears here. Monitor this 24/7 — get alerted when a failure is confirmed. [Start free](/auth/sign-up) Only run these tools against systems you own or are authorized to test. Using them to scan or probe systems without permission violates our [Terms](/legal/terms). ## The security headers grade scale Every check returns one of these grades, with the exact reasons and the config that fixes each one. A page we could not load — no response, a 5xx error page, or a redirect we were told not to follow — gets no grade at all. A+ Excellent HTTPS with a year-long HSTS policy covering subdomains, an enforcing Content-Security-Policy that really restricts scripts, clickjacking protection, nosniff, a Referrer-Policy, a Permissions-Policy and safe cookies. A Good Well protected, one step short of A+: usually no Permissions-Policy or Referrer-Policy, or an HSTS policy shorter than a year or without includeSubDomains. B Needs attention A real gap: a CSP that still allows inline or eval'd scripts or any https: source, no clickjacking protection, no nosniff, a short HSTS policy, or cookies sent without Secure. C Weak A main defence is missing: no enforcing Content-Security-Policy, or no Strict-Transport-Security on an HTTPS site. F Failing The page is served over plain HTTP, where none of these headers can be trusted. ## Every rule, in full The grade starts at A+ and each problem can only lower the ceiling, so the grade is always explained by the worst finding in the report. Rules version headers-2026.10 . Grade at most When F Final page served over plain http:// — every header can be stripped or rewritten in transit C No Content-Security-Policy at all C Only Content-Security-Policy-Report-Only — the policy watches but blocks nothing C HTTPS without Strict-Transport-Security (or with max-age=0) C A cookie with SameSite=None but no Secure flag — browsers reject it B CSP sets no script-src or default-src, so scripts are not restricted B CSP allows 'unsafe-inline' scripts without a nonce, hash or 'strict-dynamic' B CSP allows 'unsafe-eval' B CSP allows scripts from *, any https:/http: origin or data: URLs (without 'strict-dynamic') B No clickjacking protection: neither X-Frame-Options DENY/SAMEORIGIN nor CSP frame-ancestors B HSTS max-age shorter than 180 days B X-Content-Type-Options: nosniff missing B Referrer-Policy: unsafe-url — full URLs, query strings included, go to every site B A cookie set on an HTTPS page without the Secure flag A HSTS max-age shorter than one year A HSTS without includeSubDomains A No Referrer-Policy, or no-referrer-when-downgrade (browsers then send full URLs cross-origin) A No Permissions-Policy — HSTS preload directive: reported, not graded — Cross-Origin-Opener/Resource/Embedder-Policy: credited when present, never required — Cookies without HttpOnly or SameSite, Server / X-Powered-By version disclosure, a legacy X-XSS-Protection filter: reported, not graded — A 4xx page is graded with a note; a 5xx page, an unfollowed redirect or no response gets no grade [How WatchFor grades everything the same way](/grades#security-headers) ## What is Security Headers Checker ? HTTP security headers are instructions a site gives the browser about what it may and may not do with the page: only ever use HTTPS for this host ( Strict-Transport-Security ), only run scripts from these origins ( Content-Security-Policy ), don't let other sites frame me ( X-Frame-Options , or CSP frame-ancestors ), don't guess content types ( X-Content-Type-Options ), don't leak my URLs to third parties ( Referrer-Policy ), and don't let this page use the camera ( Permissions-Policy ). Each one closes a class of attack that the application code can't close on its own. This tool fetches a URL from a real probe location and audits those headers: which are present, their exact values, and what each missing one leaves open. It's the same response a browser gets — including whatever a CDN or reverse proxy added or stripped on the way — so it tells you what users actually receive rather than what the application config says. Every check ends in a WatchFor Grade from A+ to F. The grade starts at A+ and each problem can only lower the ceiling, so the letter is always explained by the worst finding — listed first, in plain English, with the exact fix and ready-to-paste config for nginx, Apache, Caddy and Cloudflare. The rules are published in full under the tool as rubric headers-2026.10 . ## How it works One request, read the way a browser reads it: - 1 GET the URL — From the probe location nearest you (or the one you pick), following redirects by default, so the headers are from the final page rather than from a 301. - 2 Extract the security set — Seven headers are audited: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and the legacy X-XSS-Protection — plus the cross-origin isolation headers and the Secure, HttpOnly and SameSite flags of every cookie the page sets. Every other response header is listed below them. - 3 Grade it — Start at A+; each finding caps the grade. A missing CSP or HSTS caps at C, a CSP that still allows inline scripts or a cookie without Secure at B, a missing Permissions-Policy at A. Plain HTTP is an F — no header can protect a page that travels in clear text. - 4 Explain each one — Present headers show their value; missing ones show what the absence permits. The full header list is there for anything else — Server version leaks, cookies without Secure , cache headers on private pages. For HSTS specifically — max-age, includeSubDomains and preload eligibility — the HSTS checker goes a level deeper. ## When you'd use it ### Before a penetration test Missing security headers are the first page of every pentest report. Add them first and let the testers spend their time on findings that need thought. ### After adding a CDN or proxy Cloudflare, a WAF or an nginx reverse proxy can add, override or drop headers. Check the public URL after the change, not the origin. ### Verifying a CSP rollout Content-Security-Policy is easy to get wrong and hard to see. Confirm the header is the one you meant — report-only vs enforcing, the right script-src — on the pages that matter. ### Checking a vendor-hosted page The marketing site on a page builder, the docs on a SaaS, the status page. You don't control their config but you're the one named on the page. Know what they send. ## Reading the result ### The grade A+ means HTTPS with a year-long HSTS policy covering subdomains, an enforcing CSP that really restricts scripts, clickjacking protection, nosniff, a Referrer-Policy, a Permissions-Policy and safe cookies. Each letter below that names its reason. No grade means we couldn't see the page — no response, a 5xx error page, or a redirect you asked us not to follow — and is never a verdict on the site. ### Strict-Transport-Security max-age=31536000; includeSubDomains; preload is the target. Anything shorter than a year isn't preload-eligible; missing means the first visit can be hijacked over HTTP. ### Content-Security-Policy The most powerful and the most work. A policy with 'unsafe-inline' in script-src blocks little; a strict nonce- or hash-based one blocks most XSS. Content-Security-Policy-Report-Only observes without enforcing — useful while rolling out, not protection. ### X-Frame-Options and frame-ancestors DENY or SAMEORIGIN stops clickjacking. CSP's frame-ancestors supersedes it and allows specific origins; send both for older browsers. ### The rest X-Content-Type-Options: nosniff (always). Referrer-Policy: strict-origin-when-cross-origin or stricter. Permissions-Policy disabling features you don't use. X-XSS-Protection: 0 if sent at all — the filter it toggles caused more harm than good. ## Check it yourself curl -sI https://example.com | grep -iE 'strict-transport|content-security|x-frame|x-content-type|referrer-policy|permissions-policy' -I sends HEAD; some servers return different headers to GET. Use -s -o /dev/null -D - for a GET. ## Common pitfalls ### Setting headers only on HTML APIs, error pages and static assets served by a different path or a different service often miss them. The browser applies HSTS from any response; CSP matters on every document. ### A CSP that breaks the site Deploy in Report-Only first, collect violations, then enforce. An enforcing policy that blocks your own analytics or payment iframe is a customer-facing outage. ### Duplicate or conflicting headers The app sets one CSP, the proxy adds another; the browser applies both, intersected — usually stricter than either author intended. The full header list shows duplicates. ## Run Security Headers Checker on every change, not just once. Get alerted when an outage is confirmed — across HTTP, DNS, SSL, RDAP, ping, blacklist and more. Free forever for 15 monitors. No card. [Start free](/auth/sign-up) ## Frequently asked questions What does the security headers grade mean? It's a WatchFor Grade from A+ to F for the headers a browser receives from the URL. The grade starts at A+ and every problem can only cap it, so the worst finding decides the letter. Each finding shows what it means, the exact fix and config for nginx, Apache, Caddy and Cloudflare. How is the grade calculated? With the published rubric headers-2026.10 , shown in full on this page. Roughly: plain HTTP caps at F; no enforcing Content-Security-Policy or no HSTS on HTTPS at C; a CSP allowing inline, eval'd or any-origin scripts, no clickjacking protection, no nosniff, an HSTS max-age under 180 days or a cookie without Secure at B; HSTS under a year or without includeSubDomains, no Referrer-Policy or no Permissions-Policy at A. HSTS preload, cross-origin isolation headers, version disclosure and HttpOnly are reported but don't cap. How does this compare to securityheaders.com? Both read the response headers a URL sends. This checker publishes its whole rubric with a version id, lists the reason for every point lost with server-specific fixes, grades cookie flags, and makes the request from a real probe location you can choose. Different rubrics weigh things differently, so the letters won't always match. Why did I get no grade? We only grade a page we could actually see. No response from our location, a 5xx error page, or a redirect with Follow redirects off gives no grade — the headers of an error page or a 301 say little about the real page, and a network problem on our side is never your F. Which security headers should every site have? Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options: nosniff, X-Frame-Options (or CSP frame-ancestors), Referrer-Policy and Permissions-Policy. Six headers, one afternoon, most of a pentest's low-hanging findings gone. Are security headers a ranking factor? Not directly. HTTPS is; HSTS makes HTTPS stick. Their value is in what they prevent, not in search position. Where do I set them? Wherever the response is assembled last: the web server config (nginx add_header , Apache Header set ), the framework's middleware, or the CDN's response-header rules. Then verify on the public URL. What does a good Content-Security-Policy look like? default-src 'self'; script-src 'self' 'nonce-…'; object-src 'none'; base-uri 'self'; frame-ancestors 'none' is a strong starting shape. Add the specific origins you load from; avoid 'unsafe-inline' and wildcards in script-src . Is X-XSS-Protection still needed? No. Modern browsers removed the filter; where it existed it introduced vulnerabilities. Send 0 for legacy browsers or omit it. CSP is the real XSS defence. Why does my API need security headers? HSTS still applies (browsers learn it from any response on the host), nosniff prevents JSON being interpreted as HTML in odd cases, and a CSP of default-src 'none' on API responses stops a reflected response being rendered. Cheap to add, no downside. ## Related web tools - [HTTP HeadersInspect response headers, status, redirect chain and security headers.](/http-header-checker) - [Software Exposure CheckerSee which software versions your website reveals in its headers and HTML — web server, PHP, CMS, JavaScript libraries — and whether any is outdated, past end of life or has known CVEs. Graded A+ to F, with the fix for each. One plain GET, no signup.](/software-exposure-checker) - [PHP Version CheckerCheck your PHP version, EOL date and known CVEs — php2shell (CVE-2026-109618, CVE-2026-109619) first — from the headers your server already sends. Graded A+ to F, with the exact version to upgrade to. Passive: plain GET requests only, no signup.](/php-version-checker) - [MCP Server CheckerTest a Model Context Protocol server the way an agent does — initialize handshake, protocol version, HTTPS, sign-in discovery and the full tool inventory — and get an A+ to F grade with the exact fix for every problem. Open servers are never marked down for being open.](/mcp-server-checker) --- Canonical page: https://watchfor.io/security-headers-checker · Site guide: https://watchfor.io/llms.txt