How do I check if my website has the right security headers?

Enter your URL in ZaxisMedia's free Security Headers Checker to instantly audit headers like CSP, HSTS, and X-Frame-Options with no signup.

What are HTTP security headers?

Response headers that instruct browsers how to behave securely, for example, HSTS forces HTTPS, Content-Security-Policy blocks malicious scripts, and X-Frame-Options prevents clickjacking.

WEBSITE SECURITY TOOLS · FREE ONLINE TOOL

Security Headers Checker

Scan a site's security headers and get an A–F gradeSome of the strongest security upgrades on the web cost nothing and take minutes: response headers that block entire attack classes. This checker grades any site A to F on the six headers that matter most.

✓ Free to use✓ No sign-up✓ Ready in your browser

// SECURITY HEADERS CHECKER · GET STARTED

Use Security Headers Checker

Scan a site's security headers and get an A–F grade

// SECURITY HEADERS CHECKER · HOW IT WORKS

How to use the Security Headers Checker

Enter website URL

Enter the website URL to scan (e.g. https://example.com).

Check headers

Click "Check security headers".

Review grade

Review your A–F grade and work through each header's recommendation.

// SECURITY HEADERS CHECKER · ABOUT THIS TOOL

About the Security Headers Checker

Some of the cheapest security wins on the web are response headers, a few lines of server config that block entire classes of attacks. This checker fetches a site's real response headers, evaluates HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, and grades the result from A to F. Each finding includes a concrete fix recommendation, so you can harden a site in one sitting.

Where it helps most

The fastest pre-launch security pass there is.

Pre-launch hardening

Harden a site in one sitting with concrete fix recommendations instead of reading specs for a week.

Client audits

Deliver a clear, graded security pass as part of client audit work.

Post-migration re-checks

Re-verify headers after server moves, since config like this gets lost in migration.

Afternoon hardening sprints

Work the recommendations in order and climb most sites from F to A in a single afternoon.

Climbing the grade

The order that lifts most sites from F to A.

HSTS and X-Frame-Options first

Low-risk wins: one line forces HTTPS everywhere, the other stops clickjacking.

Referrer and content-type next

Referrer-Policy and X-Content-Type-Options follow with minimal testing needed.

CSP comes last

The most powerful header and the most demanding: test in report-only mode before enforcing.

Security Headers Checker: built for trust

Every finding ships with a concrete fix recommendation, and the grade weighting is fully transparent. No signup needed.

// SECURITY HEADERS CHECKER · COMMON QUESTIONS

Security Headers Checker FAQs

How is the security grade calculated?

Each header scores on presence and strength: HSTS and Content-Security-Policy count 25 points each, X-Frame-Options and X-Content-Type-Options 15 each, and Referrer-Policy and Permissions-Policy 10 each. 90 or above earns an A; below 55 is an F.

Will adding security headers break my site?

Do security headers affect SEO?

Which header should I add first?

Why does my site score an F?

tools-guide

Security Headers Checker: Grade Your Site's Defenses

Free security headers checker. Instantly scan HSTS, CSP, X-Frame-Options and more on any site, get an A to F grade and clear steps to fix every website gap.

Read article →