Free tool
HTTP header checker
See exactly which headers a URL returns and how its security headers score. Useful after a CDN, proxy or framework change.
Free to use, limited to 30 checks per hour per IP address. Results may be cached for a few minutes. More free tools
How the grade is calculated
Six headers are scored. Each present header adds its points, for a maximum of 100.
| Header | Points | Why it matters |
|---|---|---|
| Strict-Transport-Security | 25 | Forces HTTPS on future visits and blocks protocol downgrade attacks. |
| Content-Security-Policy | 25 | Limits where scripts, styles and other resources may load from. The main defence against XSS. |
| X-Content-Type-Options | 15 | Set to nosniff to stop browsers guessing content types. |
| Referrer-Policy | 15 | Controls how much of the URL is sent to other sites in the Referer header. |
| X-Frame-Options | 10 | Prevents your pages being framed by other sites (clickjacking). |
| Permissions-Policy | 10 | Disables browser features such as camera or geolocation that your site does not use. |
Grades: A at 90 or more, B at 75, C at 55, D at 35, F below 35. The check looks for presence, not for the quality of each value.
Headers drift after deploys
Security headers are often set in a proxy, CDN rule or framework config and disappear silently during a migration. Re-check after infrastructure changes, and compare the full header list to what you expect.
Frequently asked questions
Are cookies shown?
Does the checker follow redirects?
My grade is F but the site works. Is that a problem?
Monitor this continuously — free
Asniher runs these checks on a schedule, verifies failures to avoid false alarms, and alerts you by email, Slack or Discord.