server-assisted
Security headers
Graded report for HSTS, CSP, clickjacking protection, cookie flags and version disclosure.
we send one GET request from our server and read only the response headers
Enter a URL above to fetch its headers.
How the grade is decided
The same anonymous request as the header inspector, graded across nine checks: HTTPS, HSTS, Content-Security-Policy, clickjacking protection, MIME sniffing, Referrer-Policy, Permissions-Policy, cookie flags and version disclosure. Any failure caps the grade, because one open door makes the locked ones less interesting.
The rules follow what browsers actually enforce today, not a checklist from a decade ago. CSP frame-ancestors supersedes X-Frame-Options, and unsafe-inline alongside a nonce is tolerated because modern browsers ignore it.
I set every header and still do not get an A. Why?
Presence is not the same as effect. HSTS with a two-minute max-age, a CSP that allows unsafe-eval, or X-Frame-Options with a value browsers stopped honouring all count as present and still leave the hole open. The detail line for each check says which one it is.
Which header should I add first?
In this order: HTTPS everywhere, then HSTS, then frame-ancestors, then a Content-Security-Policy. The first three are one-line server changes with no application impact. CSP is the one that needs actual work, so it goes last.
Does a strict CSP break my site?
It can, which is why you start with Content-Security-Policy-Report-Only. Violations get reported and nothing is blocked; when the reports go quiet, you move the same policy to the enforcing header. This tool shows which of the two you are currently sending.
Why is the Server header flagged only sometimes?
A bare product name tells an attacker almost nothing. A version number tells them exactly which exploits to try. The check flags the version, not the banner.
Related tools: CSP analyzer, HTTP headers and SSL / TLS audit.