HTTP security headers checker

How to get the headers to paste

The quickest way is curl -sI https://your-site/, which sends a HEAD request and prints only the headers. Add -L to follow redirects: a site that sends http:// to https://, or example.com to www.example.com, answers the first request with a redirect whose headers are often different from the page's. When you paste a whole redirect chain, the checker splits it into responses and grades the last one.

A few servers answer HEAD differently from GET. If the result looks wrong, use curl -s -D - -o /dev/null https://your-site/ (on Windows, -o NUL), which makes a normal GET request and prints the headers. In a browser, open the developer tools, go to the Network tab, reload, click the first request and copy the response headers; Chrome and Firefox both have a "Raw" toggle that gives exactly the Name: value lines this tool expects.

How the grade is worked out

Six headers are scored, out of 100. The weights are this site's own judgement of how much each header protects an ordinary website, not an industry standard: other graders weigh things differently and will not always agree with this one. What matters more than the letter is the list of findings, which says what each header does and what to send instead.

The letter follows from the total: A at 90 or more, B from 75, C from 60, D from 40, and F below that. Other things the checker notices, such as a Server header that gives away a version number, an X-Powered-By header, or a cookie without Secure, are listed as warnings but do not change the score, because their weight depends too much on the site.

A worked example

The example pre-loaded above is a typical small PHP site behind nginx. It scores 64, a C:

• HSTS is present with max-age=15768000, about 183 days. That is over the 180-day mark but under a year, so it gets 20 of 25.
• The CSP exists but allows 'unsafe-inline' scripts, which is the one thing a CSP is mostly there to stop. It also has no object-src and no base-uri. One serious problem and two warnings take it from 25 to 9.
• X-Frame-Options: SAMEORIGIN and X-Content-Type-Options: nosniff earn their full 15 each.
• There is no Referrer-Policy (5 of 10, since browsers now default to a sensible value) and no Permissions-Policy (0 of 10).

That makes 20 + 9 + 15 + 15 + 5 + 0 = 64. The fastest route to an A is to lengthen HSTS to max-age=31536000, add Referrer-Policy: strict-origin-when-cross-origin and a short Permissions-Policy, and replace 'unsafe-inline' with nonces. The first three are one line each in the server configuration; the fourth usually needs changes to the application's templates.

What each header is for

Strict-Transport-Security (HSTS)

Tells the browser to use HTTPS for this host, and never plain HTTP, for max-age seconds. It protects the moment someone types a bare domain name, which would otherwise start with an unencrypted request that an attacker on the same network could intercept. It is defined in RFC 6797, and browsers ignore it when it arrives over plain HTTP.

Content-Security-Policy

Lists where scripts, styles, images and other resources may come from. Done well, it means an attacker who manages to inject HTML into a page still cannot run script. The CSP evaluator reads a policy directive by directive.

X-Frame-Options and frame-ancestors

Stop other sites loading your page inside an invisible frame and tricking visitors into clicking on it (clickjacking). frame-ancestors in the CSP is the modern form; X-Frame-Options still works everywhere.

X-Content-Type-Options: nosniff

Stops the browser second-guessing the declared Content-Type. Without it, a file uploaded as an image could in some circumstances be run as a script.

Referrer-Policy and Permissions-Policy

Referrer-Policy controls how much of the current URL is sent to other sites when a visitor follows a link or the page loads a resource. Permissions-Policy switches off browser features (camera, microphone, geolocation, payment and so on) that the page does not use, so embedded third-party content cannot ask for them either.

Where this check stops being reliable

• It sees exactly one response. Headers often differ between the homepage, other pages, API routes and static files, especially when an application framework sets some and the web server others. Check the pages that matter, not only the root.
• It cannot tell whether the response came over HTTPS. HSTS is only honoured on HTTPS responses, so a header copied from an http:// request earns points it would not earn in a browser.
• A CDN or proxy in front of the site may add or strip headers. Paste what the public URL returns, not what the origin server returns internally.
• It does not test whether the site's TLS setup is sound, whether cookies are scoped correctly, or anything about the application itself. For the certificate, use the certificate decoder.