HTTP Security Header Checker
Grade a site's HTTP security headers and see what each missing one exposes.
🌐 sitekits fetches the URL server-side (private/internal addresses are blocked). Only response headers are read — the body is never retrieved.
Overview
Security headers are the part of a site’s defence that lives entirely in the
response, which makes them easy to check and easy to get subtly wrong. A header
can be present and still be doing nothing: max-age=0 turns HSTS off, a CSP
containing 'unsafe-inline' still runs an injected <script>, and
X-Frame-Options: ALLOW-FROM is ignored by every browser shipping today.
This checker fetches the URL server-side, reads only the response headers, and scores seven items on a weighted 100-point scale. The weights reflect what each one actually prevents, and each score comes with a note naming the specific exposure rather than a generic “header missing”.
How to use
- Paste a URL. The scheme may be omitted;
httpsis assumed. - Read the grade and the per-item scores.
- Work down the notes. Each one describes what is exposed, not just what is absent.
What the weights mean
Counting headers treats every gap as equal. It is not: a missing
X-Frame-Options can be covered by CSP frame-ancestors, while a missing CSP
has no substitute at all.
| Item | Weight | Why |
|---|---|---|
Content-Security-Policy | 25 | The only header that stops an injected script from running and exfiltrating |
Strict-Transport-Security | 20 | Stops the first request being downgraded to HTTP |
| Frame protection | 15 | Clickjacking; satisfied by CSP frame-ancestors or X-Frame-Options |
X-Content-Type-Options | 10 | A mistyped content-type being reinterpreted as script |
Referrer-Policy | 10 | How much of your URLs leak to other origins |
Permissions-Policy | 10 | Camera, microphone and geolocation left implicitly open |
| Version disclosure | 10 | A deduction, not a protection — see below |
How the values are read
CSP starts at 100 and loses points for what actually weakens it.
'unsafe-inline' in the effective script-src costs 45 — but only when no
nonce or hash is present, because browsers that understand those ignore
'unsafe-inline' entirely. 'unsafe-eval' costs 20. A missing base-uri
costs 15: without it an injected <base> element rewrites every relative URL on
the page, including script sources. A missing object-src 'none' costs 10.
Content-Security-Policy-Report-Only alone scores zero, because nothing is
blocked — it is a measurement tool, not a defence.
HSTS is scored by max-age: a year or more reaches 80, six months 60,
anything shorter 35, and max-age=0 scores 0 because it switches HSTS off.
includeSubDomains adds 20, which is what brings a correct header to 100.
Six months is also the floor for the browser preload list, so a shorter value
cannot be preloaded regardless of intent.
Frame protection is satisfied by CSP frame-ancestors at full marks, or by
X-Frame-Options: DENY/SAMEORIGIN at 60 — it still works, but the spec has
moved on. ALLOW-FROM scores 0: Chrome never implemented it and Firefox removed
it in version 70, so a page relying on it is framable.
Version disclosure is the one deduction. Server: Apache/2.4.41 and
X-Powered-By: PHP/7.4.3 tell an attacker exactly which published CVEs to try,
and neither header protects anything. A version-free value such as
Server: cloudflare is not penalised — most CDNs always send it and you cannot
remove it, so scoring it would be a mark nobody can fix.
What this cannot see
Headers are only one layer. A perfect score says nothing about your TLS configuration, your cookie flags, whether authentication is enforced, or whether the CSP allows an origin that itself hosts attacker-controlled content.
The Set-Cookie attributes in particular are not graded, because they are
per-cookie rather than per-response — a session cookie missing HttpOnly and
Secure is a serious problem that no header grade will show you.
CSP is also graded on syntax and keywords, not on your allow-list. A policy of
script-src 'self' https://cdn.example.com scores full marks, and if that CDN
serves user-uploaded JavaScript the policy provides no protection at all. The
grade measures the shape of the policy, and you have to judge the sources.
Examples
- Verifying a change reached production — grade the URL before and after a CDN configuration change. Headers set at the origin are frequently stripped or overridden by a proxy, and this is the fastest way to see the response as browsers receive it.
- Explaining a finding to a team — the notes state the mechanism, which is more persuasive than a header name in an audit spreadsheet.
- Checking a redirect target — the graded headers are the final response’s. A landing page that redirects to a different host often lands somewhere with none of the headers the entry point had.
- Before requesting HSTS preload — the submission requires
max-ageof at least a year plusincludeSubDomainsandpreload. Preloading is difficult to undo, so confirm the header on every subdomain first. - Building the policy itself — the CSP generator assembles the header directive by directive, and HTTP headers shows the complete raw response when you need the values verbatim.
Notes
The final response’s headers are graded. If the URL redirects, the grade describes where you land, and the chain is shown so you can spot an entry point whose headers differ from its destination.
Feature-Policy is accepted in place of Permissions-Policy for the same check,
since some servers still emit the older name. Referrer-Policy earns full marks
for no-referrer, same-origin, strict-origin and
strict-origin-when-cross-origin; other values score half, because they leak
more of the URL across origins than necessary.
Headers only. This tool never retrieves, stores or forwards the response body, and requests to private, loopback, link-local and reserved addresses are refused before any connection is opened — including after a redirect. The details are in the privacy policy.