Security headers checker: how well does a site protect its visitors?
Enter a URL to grade its security headers from A to F, with a breakdown of what each one is worth and what to fix first.
Grade a site
Live checkTurn any long URL into a short, trackable link.
Once the destination checks out, shorten it with click analytics by source, location and device, all in one dashboard.
What the grade measures.
Six response headers that browsers use to protect visitors, weighted out of 100.
Security headers are instructions a server sends with every page. They tell the browser to insist on HTTPS, to restrict where scripts may load from, to refuse to be framed by other sites, and to share less information when a visitor clicks away.
The score adds up the six headers below: HSTS (20), Content-Security-Policy (25), X-Content-Type-Options (15), clickjacking protection (15), Referrer-Policy (15) and Permissions-Policy (10). A page that isn't served over HTTPS is graded F, because the other headers can't make up for an unencrypted connection.
It is a quick health check on configuration, not a security audit. A site can have a perfect grade and still have vulnerabilities in its code.
Grade scale
How the score maps to a letter.
| Grade | Score | What it usually means |
|---|---|---|
| A | 90 to 100 | All major headers are set and none is weakened. |
| B | 80 to 89 | Most headers are set, one is missing or weak. |
| C | 65 to 79 | Basic protections exist, important ones are missing. |
| D | 50 to 64 | Only a few headers are set. |
| E | 30 to 49 | Little protection. |
| F | Under 30, or no HTTPS | Almost no protection, or the page isn't served over HTTPS. |
Common questions
Why did a big site get a low grade? +
Some sites rely on other protections, or set headers only on certain pages. The grade reflects the response we received for the URL you entered.
Which header should I add first? +
Strict-Transport-Security and X-Content-Type-Options are one-line additions with little risk. A Content-Security-Policy is the most valuable and also the hardest to get right.
Does a good grade help SEO? +
Not directly. HTTPS is a ranking signal, and the other headers protect visitors rather than rankings.
Where do I set these headers? +
In your web server or CDN configuration, for example nginx add_header, Apache Header set, or the response headers feature of your hosting.