Security headers checker — grade any site in seconds
Enter a URL. Get an A–F grade plus every security header present or missing — CSP, HSTS, clickjacking protection and more. Free, no account.
Check a site now See DeskUptime →Check security headers
One URL per check. Everything runs live — nothing is stored.
Prefer the terminal? Check from the open-source CLI:
curl -sI https://yoursite.com | grep -iE 'content-security|strict-transport|x-frame|x-content-type'
What the headers actually protect against
A passing SSL padlock says nothing about how the page behaves once loaded. These headers do.
Content-Security-Policy
Blocks injected scripts — the payload half of most XSS attacks. The single highest-value header.
Strict-Transport-Security
Forces browsers onto HTTPS for future visits, defeating downgrade and cookie-theft attempts.
X-Frame-Options / frame-ancestors
Stops other sites embedding your pages in invisible frames to trick users into clicking (clickjacking).
| This free checker | Paid scanners | DeskUptime | |
|---|---|---|---|
| Header report + grade | ✓ free | Part of paid audits | ✓ checks each run |
| Runs on a schedule | ✗ manual | ✓ expensive | ✓ your interval |
| Status + SSL + latency too | Separate tools | ✓ | ✓ together |
| Ongoing cost | $0 | $100s/yr | $19 once |
FAQ
What are HTTP security headers?
They're instructions your server sends with every response that tell browsers what to refuse: which scripts may run (Content-Security-Policy), whether HTTP is allowed at all (Strict-Transport-Security), whether your pages can be framed (X-Frame-Options), what referrer data leaks (Referrer-Policy) and which browser features the page may use (Permissions-Policy). Missing them doesn't break the site — it just leaves known attack doors open.
How is the grade calculated?
Six headers count toward the score: HSTS, CSP, X-Content-Type-Options, X-Frame-Options (or CSP frame-ancestors), Referrer-Policy and Permissions-Policy. Cross-Origin-Opener-Policy earns a bonus presence point. Six-plus present grades A, four-to-five B, two-to-three C, one D, none F. It measures coverage, not configuration quality — a weak CSP still counts as present.
I got an F. How do I fix it?
The headers come from your server or host. Most CDNs let you set them without touching code: Cloudflare has Transform Rules and free managed transforms for several of these headers. Netlify and Vercel read them from a config file. On Apache/Nginx they go in server config. Add them one at a time and re-run this check.
Does it work with any website or stack?
Yes. This is a plain HTTPS request — no agent, plugin or platform integration. WordPress, Shopify, Webflow, static sites and API endpoints all work identically.
Can I check internal or staging URLs?
The web tool only reaches public URLs. The DeskUptime app and CLI check anything your own machine can reach — localhost, intranet hosts, staging domains behind a VPN.