Check 9 critical security headers and get a letter grade. CSP, HSTS, X-Frame-Options, Referrer-Policy, and more.
Checking headers for ...
Daily scan limit reached
Sign up free to get 10 scans/day — or upgrade for unlimited access.
Redirecting to report...
An HTTP security headers checker reads the response headers a website sends and reports which browser-level protections are switched on — Content-Security-Policy, HSTS, X-Frame-Options, and more — then grades the site A–F. Secably checks 9 critical headers instantly, free, with no signup.
Every time a browser loads a page, the server sends back a set of response headers alongside the content. A handful of these are security directives: they tell the browser to block inline scripts, refuse to be framed by other sites, force HTTPS, and stop guessing content types. Set correctly, they turn the browser itself into an extra layer of defense.
The catch is that these protections are off by default — a site works perfectly fine without any of them, so they're easy to overlook. A headers checker makes the gap visible: it shows exactly which directives are present, which are missing, and what a hardened configuration looks like.
A strong Content-Security-Policy is the single most effective defense against cross-site scripting — which sits inside the Injection category, ranked #3 in the OWASP Top 10 (2021). X-Frame-Options and frame-ancestors stop clickjacking; Strict-Transport-Security shuts down SSL-stripping downgrade attacks; and X-Content-Type-Options blocks MIME-sniffing tricks that turn an uploaded file into executable script.
Secably requests your site and inspects the raw response headers, then scores the security-relevant ones against best-practice configuration.
Requests the URL and captures every response header the server returns, following redirects to the final page.
Inspects CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and more — present, absent, or weakly configured.
Assigns an A–F grade and lists the exact directive to add for each missing or misconfigured header.
Type a domain or full URL like example.com. Secably follows redirects to the live page.
Secably reads the response headers and evaluates all 9 security directives in one pass.
Read your grade and apply the recommended header values in your web server, CDN, or app middleware. Re-check to confirm.