Security Headers Check
Enter your website’s domain. In a few seconds you know which security headers are in place, which are missing, and how to fix them.
What we check
Twelve things anyone can see from your website’s home page. The A+ to F grade comes from the six security headers only.
Connection
HTTPS
Without HTTPS, what visitors send and read can be seen or changed on the way.
HTTP to HTTPS redirect
Visitors who type the address without https:// should land on the secure version, not stay on the plain one.
Certificate expiry
An expired certificate makes browsers show a full-page warning, and most visitors leave.
Security headers (these make the grade)
Strict-Transport-Security (HSTS)
Tells browsers to always use HTTPS for your site, even when someone clicks an http:// link.
Content-Security-Policy
Limits which scripts and files the page may load, so injected code has a much harder time running.
X-Frame-Options
Stops other sites from showing your pages inside a frame to trick visitors into clicking (clickjacking).
X-Content-Type-Options
Stops browsers from guessing a file’s type and running a file as a script when it is not one.
Referrer-Policy
Controls how much of your page address is passed to other sites when visitors click a link.
Permissions-Policy
Switches off browser features your site does not use, such as the camera, microphone and location.
Other things a visitor can see
Software version shown
A version number tells attackers which known weaknesses to try.
Cookie settings
Cookies without Secure and HttpOnly can leak over plain connections or be read by injected scripts.
Mixed content
Scripts, styles or images loaded over http:// weaken an HTTPS page, and browsers may block them.