Enter a URL. Get an A–F grade plus every security header present or missing — CSP, HSTS, clickjacking protection and more. Free, no account.
Check a site now See DeskUptime →One URL per check. Everything runs live — nothing is stored.
Prefer the terminal? Check from the open-source CLI:
curl -sI https://yoursite.com | grep -iE 'content-security|strict-transport|x-frame|x-content-type'
A passing SSL padlock says nothing about how the page behaves once loaded. These headers do.
Blocks injected scripts — the payload half of most XSS attacks. The single highest-value header.
Forces browsers onto HTTPS for future visits, defeating downgrade and cookie-theft attempts.
Stops other sites embedding your pages in invisible frames to trick users into clicking (clickjacking).
| This free checker | Paid scanners | DeskUptime | |
|---|---|---|---|
| Header report + grade | ✓ free | Part of paid audits | ✓ checks each run |
| Runs on a schedule | ✗ manual | ✓ expensive | ✓ your interval |
| Status + SSL + latency too | Separate tools | ✓ | ✓ together |
| Ongoing cost | $0 | $100s/yr | $19 once |
They're instructions your server sends with every response that tell browsers what to refuse: which scripts may run (Content-Security-Policy), whether HTTP is allowed at all (Strict-Transport-Security), whether your pages can be framed (X-Frame-Options), what referrer data leaks (Referrer-Policy) and which browser features the page may use (Permissions-Policy). Missing them doesn't break the site — it just leaves known attack doors open.
Six headers count toward the score: HSTS, CSP, X-Content-Type-Options, X-Frame-Options (or CSP frame-ancestors), Referrer-Policy and Permissions-Policy. Cross-Origin-Opener-Policy earns a bonus presence point. Six-plus present grades A, four-to-five B, two-to-three C, one D, none F. It measures coverage, not configuration quality — a weak CSP still counts as present.
The headers come from your server or host. Most CDNs let you set them without touching code: Cloudflare has Transform Rules and free managed transforms for several of these headers. Netlify and Vercel read them from a config file. On Apache/Nginx they go in server config. Add them one at a time and re-run this check.
Yes. This is a plain HTTPS request — no agent, plugin or platform integration. WordPress, Shopify, Webflow, static sites and API endpoints all work identically.
The web tool only reaches public URLs. The DeskUptime app and CLI check anything your own machine can reach — localhost, intranet hosts, staging domains behind a VPN.