Help Centre

Headergrade runs on the Cloudflare Workers runtime. The Workers platform cannot open a connection to hosts that are themselves behind Cloudflare's edge. If your site is fronted by Cloudflare, the checker will see a refused connection and report the URL as unreachable.

This does not mean your server is down or your firewall is blocking the check. It is a limitation of the checker's own platform. If you receive a "cannot connect" result for a site you know is responding, this is the most likely cause.

Workaround: If you can test from a non-Cloudflare network, or from a raw IP address that bypasses the Cloudflare proxy, the check may succeed. Otherwise, the tool will note this limitation in the report.

Six headers are analysed individually:

• Content-Security-Policy — controls which sources the browser may load scripts, styles, and media from. The main defence against XSS.
• Strict-Transport-Security — forces browsers to connect over HTTPS and never fall back to plain HTTP.
• X-Content-Type-Options — stops the browser from MIME-sniffing a response into something it is not.
• X-Frame-Options — prevents your page from being embedded in another site's iframe. The defence against clickjacking.
• Referrer-Policy — controls how much of the URL is leaked to other sites when a visitor clicks a link.
• Permissions-Policy — restricts which browser features (camera, microphone, geolocation) the page may use.

All other headers received from the server are displayed in the full raw header list, but only these six get the individual analysis.

No. Headergrade does not create accounts, set cookies, log IP addresses, or store the URLs you check. Every scan is independent. The tool fetches the URL you provide, returns the analysis to your browser, and retains nothing afterwards. There is no history, no saved reports, and no way to retrieve a previous result.

See the Privacy Policy for full details.

Each header report includes a recommendation section with a specific, actionable change. For example, if X-Frame-Options is missing, the recommendation will say something like:

"Add the header X-Frame-Options: DENY to your server configuration to prevent clickjacking."

How you apply the change depends on your server platform:

• Web server config: Add the header line to your nginx, Apache, Caddy, or IIS configuration.
• CDN or edge proxy: Set the header in your Cloudflare, Fastly, or Akamai dashboard.
• Application framework: Use a middleware or security library (e.g., Helmet for Express, security headers for Django, or the built-in middleware in ASP.NET Core).
• Static hosting: Some static hosts (like Netlify, Vercel) let you set custom headers via a configuration file.

Headergrade tells you what to change, not how to change it in your specific setup. The exact configuration syntax depends on your server software. Consult your server or host documentation for the correct way to add response headers.

No. The checker runs on the public internet and can only reach publicly accessible URLs. It cannot check:

• Local or private addresses (e.g., localhost, 192.168.x.x, 10.x.x.x)
• Internal-only servers or services behind a VPN
• Password-protected or login-gated pages (the scanner does not have credentials)

If you need to check a non-public server, you would need to run a header checker from within your own network. This tool is not designed for that use case.

No. Headergrade is a diagnostics tool that reports what it receives from the target server. It is not a security audit, penetration test, or vulnerability assessment.

Headergrade does not claim compliance with any security standard, certification, or regulation — including PCI DSS, SOC 2, ISO 27001, HIPAA, or GDPR. A report from Headergrade is not a compliance audit and should not be used as one.

The tool is provided as a diagnostics aid to help you understand what headers your server is sending and what they mean. It does not replace a professional security review.

Not currently. Headergrade checks one URL at a time, and there is no scheduled or automated scanning. A Pro plan with batch checks and CSV export is under development but not yet available.

There is also no email notification system — the tool cannot send alerts, reminders, or scheduled reports. It answers when you ask it, and that is all.