Check any website's HTTP security headers and get a letter grade plus copy-paste fixes. We look at HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy, and we flag headers that leak your software versions.
HTTP security headers are the first line of defense a web server hands to every visitor's browser. They tell the browser to enforce HTTPS, block clickjacking, refuse to MIME-sniff responses, restrict which scripts can run, and limit what referrer data leaks to third parties. Missing or weak security headers are among the most common findings in any security audit, and they are usually trivial to fix once you know which ones are absent. This grader fetches your site, inspects the response headers, and assigns a letter grade based on Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. It also flags information-leak headers like Server version strings, X-Powered-By, and X-AspNet-Version that quietly advertise your software stack to attackers.
Enter a domain name or full URL and click "Grade Headers." The tool fetches the page over HTTPS (following redirects and showing you the chain), reads the response headers, and scores each security header for presence and quality. You get an overall grade, a per-header breakdown with a plain-English explanation of each finding, and a copy-paste recommended value for anything missing or weak. The full raw response headers are shown at the bottom so you can verify exactly what the server returned.
Start with the headers graded red, since those are missing entirely and usually the highest impact. Add HSTS with a long max-age plus includeSubDomains to lock in HTTPS. A Content-Security-Policy is the strongest defense against cross-site scripting, but watch for 'unsafe-inline' and 'unsafe-eval', which significantly weaken it. Set X-Content-Type-Options to nosniff and add either X-Frame-Options or a CSP frame-ancestors directive to stop clickjacking. Finally, remove headers that leak versions: turn off expose_php in PHP, suppress the Server version, and drop X-Powered-By. The grade is heuristic: it confirms a header is present and reasonably configured, but it cannot judge whether your CSP actually covers every resource your pages load.
Need reliable hosting? These free tools are brought to you by Ultra Web Hosting. Fast, secure shared and reseller hosting with 24/7 expert support. View hosting plans →