Help Centre

Last updated: August 8, 2026

Getting Started

Headergrade is a single-purpose tool: you give it a URL, and it tells you which HTTP security headers that URL's response contains — and what each one means.

  1. Go to the App page.
  2. Enter a URL (with or without https:// — we add it if missing).
  3. Click Check.
  4. Read the per-header breakdown. Each card shows the raw header value, whether it is present or missing, and what that means in plain language.

No account, no sign-up, no login. The result exists in your browser for that visit and is gone when you navigate away.

Frequently Asked Questions

What headers does Headergrade check?

Headergrade checks six security-related response headers:

  • Content-Security-Policy — restricts which resources (scripts, styles, images) the browser is allowed to load. The primary defence against XSS.
  • Strict-Transport-Security — tells browsers to connect only over HTTPS. Prevents downgrade attacks.
  • X-Content-Type-Options — disables MIME-type sniffing.
  • X-Frame-Options — prevents your page from being embedded in an iframe (clickjacking protection).
  • Referrer-Policy — governs how much referrer information is sent with navigation requests.
  • Permissions-Policy — restricts which browser features (camera, microphone, geolocation) your page can access.

If a header is absent, the tool says so — it never infers a value. Headers beyond these six are not inspected.

How do I interpret a missing header?

A missing header is reported plainly: Missing. The explanation for that header will describe what it protects against and what the risks are when it is absent. It will also suggest what a reasonable configuration would look like — for example, X-Content-Type-Options: nosniff is the only value that header accepts.

The result is based on a single HTTP request. Configured proxies, CDNs, or load balancers may add, strip, or override headers before they reach your browser. If Headergrade reports a header as missing, verify the configuration at the edge (CDN / reverse proxy) as well as at the origin server.

Why does Headergrade say my site is unreachable when it loads fine in my browser?

This is almost always a Cloudflare-to-Cloudflare limitation. Headergrade runs on Cloudflare Workers. Cloudflare does not allow a Worker to open a TCP socket to a host that is also behind Cloudflare. If your site uses Cloudflare as its DNS and reverse proxy, the Worker will not be able to connect.

This is a platform limitation, not a configuration problem on your side. Your site's actual security headers may be perfectly configured — the tool simply cannot reach it from its runtime environment. To verify your headers from a non-Cloudflare vantage point, you can use curl -I https://yoursite.com from a local terminal or a hosted VM outside Cloudflare's network.

Does Headergrade store the URLs I check?

No. Each URL you submit is sent to our server to perform the header fetch, processed in memory, and the result is returned to your browser. We do not log, store, or retain URLs or results. We do not set cookies, and we do not use analytics.

See the Privacy Policy for the full details.

What is the difference between Free and Pro?

The Free tier gives you single-URL header checking with full per-header analysis, raw values, redirect tracking (up to 3 hops), and plain-language explanations. This is fully operational today.

Pro ($12/month) is planned and not yet available. When it launches, it will add bulk URL checking (up to 50 URLs), API access, and configurable user-agents. A connected payment processor is required before subscriptions can be taken — this is not yet in place. See the Pricing page.

How do I fix a misconfigured header?

The explanation card for each header includes a recommendation in plain language. For example, if Strict-Transport-Security is missing, it will recommend adding Strict-Transport-Security: max-age=31536000; includeSubDomains to your origin server's response headers — and warn you to test with a short max-age first before committing to a full year.

Where to make the change depends on your setup:

  • Origin server — in your web server config (Nginx, Apache, Caddy, IIS) or application middleware.
  • CDN / reverse proxy — Cloudflare, Fastly, Akamai, AWS CloudFront all have header management rules.
  • Platform middleware — frameworks like Express (Node.js), Django (Python), Spring Boot (Java) or Rack (Ruby) typically have security-header middleware.

Headergrade can tell you what to set, but not where in your specific stack to set it — that depends on your architecture.

Known Limitations

Cloudflare-to-Cloudflare blocking. Headergrade runs on Cloudflare Workers. A Worker cannot open a TCP socket to another Cloudflare-hosted origin. Sites behind Cloudflare will report as unreachable. This is a platform restriction, not a result about the target's header configuration.
Single request, no caching. Every check is a single HTTP fetch from a single geographic region. Results may differ from what a browser in another region would see. We do not cache results or offer scheduled re-checks.
Six headers only. Headergrade inspects exactly the six headers listed above. Headers outside this set (e.g., Set-Cookie, Access-Control-Allow-Origin, Cache-Control) are ignored.
No accounts, no history. There is no user account system. Check results exist only in your browser for the duration of the page visit. You cannot save, share, or retrieve a past result.
Pro not yet available. The Pro tier (bulk checking, API access) is planned but has not launched. No payment processor is connected. Do not submit payment information — no checkout form on this site is functional.
No legal entity registered. Headergrade is operated by an individual who has not yet registered a company or established a jurisdiction. See the Terms of Service for details.

Contact Us

Email support is not yet available. This service does not have a mailbox or a contact form that can receive messages. If you supply an email address on any page on this site, messages to that address cannot be received — the address does not exist.

Because Headergrade is a small, operator-run tool without a registered business entity or a communications infrastructure, there is currently no public contact route.

If you have found a bug, have a feature request, or need to report an issue with the tool, the recommended path is to submit an issue on the repository or platform where this service is deployed. The operator monitors those channels.

If you require a direct contact method for a specific reason (security vulnerability report, legal inquiry, removal request), this requirement has been noted and the operator is aware that a contact route needs to be established.

For the operator: If you are reading this, a contact mechanism (email address or form handler) needs to be set up before support can receive messages. Record this in your project's tracking system.