HTTP security headers, inspected.

Type a URL, get a per-header readout of what is set, what is missing, and what to change — in plain language with the raw value shown. No score. No dashboard. Just the facts.

Check a URL

Headers checked

Each header is evaluated individually with a plain-language explanation of what it protects against and what to change if it is missing or misconfigured.

Content-Security-Policy Controls which resources (scripts, styles, images) the browser is allowed to load. The first line of defence against XSS attacks.

Strict-Transport-Security Tells browsers to only connect via HTTPS, preventing downgrade attacks. Recommended: max-age of at least one year.

X-Content-Type-Options Disables MIME-type sniffing, preventing browsers from interpreting files as a different content type than declared.

X-Frame-Options Controls whether your page can be embedded in an iframe, preventing clickjacking attacks.

Referrer-Policy Controls how much referrer information is sent with navigation requests between pages.

Permissions-Policy Restricts which browser features (camera, microphone, geolocation) your page and embedded content can access.

How it works

Enter a URL. Headergrade fetches it server-side, follows up to three redirects, and returns each security header found — or notes its absence. Every result includes a plain-language explanation of what the header does, what the current value means, and what to change if it is missing or misconfigured.

No accounts. No data storage. No scheduled scans. The result you see is the result of a single request, reported as received.

Platform note: Headergrade runs on Cloudflare Workers. Targets that are behind Cloudflare may report as unreachable because Cloudflare does not allow a Worker to open a TCP socket to a host also on Cloudflare. This is a platform limitation, not a result about the target's own configuration.