Security headers checker

Enter a URL to grade its HTTP security headers and see which are missing or weak. Free, no sign-up.

What we check

Six headers make up the grade. All six with no serious issues earns an A+.

Content-Security-PolicyLimits where scripts can load from. Stops most XSS.
Strict-Transport-SecurityForces https, so connections cannot be downgraded.
X-Frame-OptionsStops other sites framing your pages (clickjacking).
X-Content-Type-OptionsStops browsers running files as the wrong type.
Referrer-PolicyKeeps your URLs from leaking to other sites.
Permissions-PolicyTurns off camera, mic and other unused features.

A baseline to start from

Set the headers once, at your CDN, load balancer or web server.
Send them on every response, including redirects and error pages.
Run this check again after each deploy.

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src 'self'; frame-ancestors 'self'
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()

Headers are the start, not the finish

Good headers limit the damage of an attack. They do not find the XSS, the broken access control or the leaky API behind it. GhostProbe runs a full penetration test on your app and a person reviews every finding.

Run a pentest