Headergrade
Security headers, explained.
Your site's HTTP response headers say a lot about how well it is protected — and most of it goes unread. Headergrade fetches a URL and tells you, header by header, what is set, what it means in plain language, and the one-line change that would improve it.
What the report covers
Six headers matter most when someone says "your headers are wrong". For each one the report shows the raw value the server actually sent, whether that value is doing anything useful, and what to change. No score out of a hundred — a header is either present and effective, present but weak, or absent.
| Header | What it does |
|---|---|
Content-Security-Policy | Controls which sources the browser may load scripts, styles and media from. The main defence against XSS. |
Strict-Transport-Security | Forces browsers to connect over HTTPS and never fall back to plain HTTP. |
X-Content-Type-Options | Stops the browser from MIME-sniffing a response into something it is not. |
X-Frame-Options | Prevents your page from being embedded in another site's iframe — the defence against clickjacking. |
Referrer-Policy | Controls how much of the URL is leaked to other sites when a visitor clicks a link. |
Permissions-Policy | Restricts which browser features — camera, microphone, geolocation — the page may use. |
How it works
-
01
Type a URL
Any public http or https address. The checker follows a couple of redirects and nothing else — it never crawls your site or follows links.
-
02
We read what the server actually sends
The scanner fetches the URL and records every response header it receives. If a header is absent, the report says absent — it never infers a value.
-
03
Read the report
Each header gets its own section: the raw value, a plain-language explanation of what it means, and a one-line action if it should change.
One honest limit
cannot connect — that is a limitation of the
checker's platform, not a statement about your server's firewall. If you get an unreachable result
for a site you know is up, the scanner is refusing the connection, not your site.
Run the check
It takes a few seconds. The report answers when you ask it — there are no accounts, no saved history, and no email.
Check your URL now