Security Headers Scanner
Check if a website implements essential HTTP security headers and receive an A–F grade based on coverage.
Why security headers matter
HTTP security headers are a low-effort, high-impact way to harden a website against common attacks. They are sent by the server and interpreted by the browser — no JavaScript required.
| Header | Protection |
|---|---|
| Strict-Transport-Security | Forces browsers to use HTTPS for the domain, preventing protocol downgrade attacks and cookie hijacking over HTTP. |
| Content-Security-Policy | Restricts which scripts, styles and resources the page can load, significantly reducing XSS attack surface. |
| X-Frame-Options | Prevents the page from being embedded in an iframe on another domain, blocking clickjacking attacks. |
| X-Content-Type-Options | Tells the browser not to guess the MIME type of a response, preventing MIME-sniffing attacks. |
| Referrer-Policy | Controls how much referrer information is sent when navigating away from the page. |
| Permissions-Policy | Restricts access to browser features like camera, microphone and geolocation that the page does not need. |
Scoring
Each header is weighted by impact: HSTS and CSP (high, 30 pts each), X-Frame-Options and X-Content-Type-Options (medium, 20 pts each), Referrer-Policy and Permissions-Policy (low, 10 pts each). The raw score is normalised to 100. Grades: A ≥ 90, B ≥ 75, C ≥ 60, D ≥ 40, F below 40.