HTTP Security Headers Checker

Check 9 critical security headers and get a letter grade. CSP, HSTS, X-Frame-Options, Referrer-Policy, and more.

Checking headers for ...

Daily scan limit reached

Sign up free to get 10 scans/day — or upgrade for unlimited access.

Redirecting to report...

Quick answer

An HTTP security headers checker reads the response headers a website sends and reports which browser-level protections are switched on — Content-Security-Policy, HSTS, X-Frame-Options, and more — then grades the site A–F. Secably checks 9 critical headers instantly, free, with no signup.

  • 9 headers: CSP, HSTS, X-Frame-Options & more
  • A–F security grade with what to fix
  • Recommended values for each header
  • Free, no signup, instant results

What are HTTP security headers?

Every time a browser loads a page, the server sends back a set of response headers alongside the content. A handful of these are security directives: they tell the browser to block inline scripts, refuse to be framed by other sites, force HTTPS, and stop guessing content types. Set correctly, they turn the browser itself into an extra layer of defense.

The catch is that these protections are off by default — a site works perfectly fine without any of them, so they're easy to overlook. A headers checker makes the gap visible: it shows exactly which directives are present, which are missing, and what a hardened configuration looks like.

Which attacks these headers stop

A strong Content-Security-Policy is the single most effective defense against cross-site scripting — which sits inside the Injection category, ranked #3 in the OWASP Top 10 (2021). X-Frame-Options and frame-ancestors stop clickjacking; Strict-Transport-Security shuts down SSL-stripping downgrade attacks; and X-Content-Type-Options blocks MIME-sniffing tricks that turn an uploaded file into executable script.

How the headers check works

Secably requests your site and inspects the raw response headers, then scores the security-relevant ones against best-practice configuration.

— Fetch

Read the response

Requests the URL and captures every response header the server returns, following redirects to the final page.

— Evaluate

Check 9 headers

Inspects CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and more — present, absent, or weakly configured.

— Grade

Score & recommend

Assigns an A–F grade and lists the exact directive to add for each missing or misconfigured header.

How to check your security headers in 3 steps

1

Enter a URL

Type a domain or full URL like example.com. Secably follows redirects to the live page.

2

Run the check

Secably reads the response headers and evaluates all 9 security directives in one pass.

3

Fix the gaps

Read your grade and apply the recommended header values in your web server, CDN, or app middleware. Re-check to confirm.

Who uses a headers checker

dev
Ship a hardened baseline
Developers: verify your CSP and HSTS are actually being sent after a deploy, and catch a header that a framework upgrade silently dropped.
ops
Standardize across every property
Sysadmins & ops: confirm the same header policy is applied consistently across all sites behind your server or CDN config.
sec
Close XSS and clickjacking gaps
Security teams: grade properties at a glance, prioritize the missing CSP and HSTS, and produce evidence for audits.

Frequently Asked Questions

What are HTTP security headers? +
HTTP security headers are response headers that instruct the browser to enable protections — preventing XSS (Content-Security-Policy), clickjacking (X-Frame-Options), MIME sniffing (X-Content-Type-Options), and downgrade attacks (Strict-Transport-Security).
What is Content-Security-Policy (CSP)? +
CSP is the most powerful security header. It controls which origins can load scripts, styles, images, and other resources. A properly configured CSP prevents most XSS and data injection attacks by blocking unauthorized scripts.
What grade should my website get? +
Aim for at least a B. A top grade requires all 9 security headers configured correctly. The two most critical are Content-Security-Policy and Strict-Transport-Security — start with those.
How do I add security headers to my site? +
Security headers are set in your web server config (Nginx add_header, Apache Header set), CDN settings (Cloudflare, CloudFront), or app middleware (Django SecurityMiddleware, Express helmet). Secably's report includes the recommended value for each.
Is this headers checker free? +
Yes. Header checks and grading are free with no signup. A free account saves your reports; Pro plans add scheduled re-checks with alerts when a header changes, plus API access.

Related security tools