How to use Security Headers Checker
The Security Headers Checker fetches a URL and grades the HTTP response headers that tell browsers how to treat your site: HSTS, Content-Security-Policy, clickjacking protection, MIME sniffing, Referrer-Policy, and Permissions-Policy. You get an A–F grade, a score out of 100, and a fix line for each failing check. The grader is ToolsHub’s own model — simpler than Mozilla Observatory, aimed at webmasters who need a punch list rather than a research paper.
- Enter the page URL (https is required for a meaningful HSTS result).
- Click Grade. We GET the URL with SSRF protections and read the response headers.
- Read the letter grade and the table. Fail and warn rows are the ones to fix first.
- Apply the recommended header on your origin or CDN, then re-run the check.
- Use Analyze deeper if you also need the certificate, redirect chain, or on-page SEO.
How the ToolsHub grade is calculated
Every site starts at 100. Missing HSTS on HTTPS costs 20, missing CSP costs 25, missing clickjacking protection costs 15, missing nosniff costs 10, and missing Referrer-Policy or Permissions-Policy cost 5 each. Unsafe-inline in script-src is a warning (-12), not a full fail. Strong HSTS with preload and COOP can add a few bonus points. Scores map to A (90+), B (80–89), C (70–79), D (50–69), and F (below 50). The model is documented so you can disagree with a weighting — it is guidance, not a pentest.
| Score | Grade |
|---|---|
| 90–100 | A |
| 80–89 | B |
| 70–79 | C |
| 50–69 | D |
| 0–49 | F |
What to set first
If the site is already on HTTPS, add Strict-Transport-Security with max-age of at least 15552000 (180 days) and includeSubDomains once every subdomain is ready. Add X-Content-Type-Options: nosniff and X-Frame-Options: DENY (or CSP frame-ancestors) the same day — they rarely break pages. CSP is the high-value, high-effort header: start in report-only, lock default-src and script-src, then enforce. Referrer-Policy: strict-origin-when-cross-origin and a tight Permissions-Policy are quick wins after that. Do not rely on X-XSS-Protection; browsers have dropped it.
Glossary
- HSTS
- HTTP Strict Transport Security — tells browsers to use HTTPS only, including on later visits.
- CSP
- Content-Security-Policy — restricts which scripts, styles, and origins a page may load.
- Clickjacking
- A UI-redressing attack that embeds your page in a hidden iframe; X-Frame-Options and CSP frame-ancestors mitigate it.
- MIME sniffing
- When a browser guesses a response type instead of trusting Content-Type; nosniff disables that guess.
- COOP
- Cross-Origin-Opener-Policy — isolates the browsing context from cross-origin popups.
Related reading
Frequently Asked Questions
Why use Security Headers Checker?
- See missing HSTS and CSP immediately instead of scrolling a raw header dump
- Distinguish pass, warn, fail, and informational checks
- Copy a shareable link so a teammate can re-run the same URL
- Jump to HTTP Headers, SSL Checker, or Website Analyzer without retyping the URL
Common use cases
- Harden a new production domain after enabling HTTPS
- Verify a CDN or reverse proxy is forwarding security headers
- Compare staging vs production header policy
- Prepare a checklist before a security review
- Explain to a client why “the site loads” is not the same as “headers are set”
Get weekly tool tips & updates
New tools, power-user tips, and productivity hacks — delivered free every Friday.
No spam, ever. Unsubscribe with one click.
Related Network & DNS
HTTP Headers Checker
View HTTP response headers for any URL. Check status codes, security headers, caching, redirects, and server details instantly. Free and private.
SSL Certificate Checker
Check SSL/TLS certificate validity, issuer, expiry date, and remaining days for any domain to prevent HTTPS outages and certificate trust errors.
TLS Version Checker
Check which TLS protocol versions a server supports, from legacy TLS 1.0 and 1.1 to modern TLS 1.2 and 1.3. A free TLS version checker that runs a real handshake.
Website Analyzer
Analyze any public website for technical SEO, HTTP status, security headers, SSL, robots.txt, sitemap signals, and DNS — one URL, an actionable report.
Redirect Checker
Trace the full redirect chain of any URL. See every 301, 302, 307 redirect hop, final destination, and HTTP status codes.
DNS Lookup Tool
Look up DNS records for any domain — A, AAAA, MX, NS, TXT, CNAME, SOA, and CAA records. Free, instant results pulled from authoritative nameservers.
Explore all Network & DNS.