Security headers checker:
are yours actually protecting?

Paste your URL above. We fetch it and read every security-relevant response header: HSTS, CSP, X-Frame-Options / frame-ancestors, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP/COEP/CORP, info-leak headers, and the flags on every Set-Cookie. The values are analyzed, not just their presence. You get a letter grade, a prioritized fix list and per-server config snippets. Free, no signup.

No — and any tool that implies it is overclaiming. Security headers are browser-side seatbelts: they contain damage (an injected script that can't run, a login page that can't be framed, a session cookie that can't leak over plain http). They don't fix the injectable code, the weak password reset, or the unpatched dependency behind them. An A+ means your responses give browsers every protection they know how to apply. That's necessary, cheap, and not sufficient.

A strict one deployed cold — quite possibly, which is exactly why CSP ships with a rehearsal mode. Deploy your policy as Content-Security-Policy-Report-Only first: browsers report every would-be violation without blocking anything. Read a week of reports, fix the inline scripts they point at (nonces are the usual road), then rename the header to enforcing. The trap is the second step never happening. Report-Only scores 8 of 25 here and caps the grade at B: it is a phase, not a destination.

Partially, and the split matters. Cross-Origin-Opener-Policy: same-origin is a cheap win: it severs window references from cross-origin pages and defuses a family of XS-Leaks. We award it bonus points. COEP is different. It gates crossOriginIsolated features like SharedArrayBuffer, and it breaks every cross-origin resource you load without explicit opt-in. Skip it if you don't need those features: we mark COEP "absent, fine" rather than penalizing it.

Less than the fuss suggests, more than zero. A determined attacker can fingerprint your stack from behavior alone, so server_tokens off is hygiene, not a lock. But automated scanners work from advertised versions, and Server: nginx/1.14.0 is an invitation to try every CVE published since 2018. It costs one config line to remove, so the cost-benefit is excellent even if the benefit is modest — which is why we weigh it at −3 points, not −30.

Only deliberately. Preload hardcodes your domain into the browsers themselves — even the first-ever visit is HTTPS-only, which closes HSTS's one real gap. But it's close to permanent: removal from the Chromium list takes months to propagate, and the requirements (max-age ≥ 1 year, includeSubDomains, every subdomain on HTTPS forever) bind hosts you haven't created yet. That intranet box on http? It stops working. Preload is the right end state for most domains — reached on purpose, not via copy-paste.

A few former best practices are now dead weight, and we flag them. X-XSS-Protection: the auditor is gone from every modern browser and was abusable on the old ones, so send nothing or 0. Expect-CT: obsolete, because browsers have required certificate transparency for new certificates since 2018. Public-Key-Pins: deprecated in 2018, after it locked real sites out of their own domains. P3P: a ghost. A modern response is defined by six headers present and these absent.

Both, ideally. Headers are set per response. The page that matters is the one that sets your session cookie: the login or app page, not the marketing homepage. This tool accepts full URLs with paths, so you can grade https://app.example.com/login directly. A common finding: the homepage scores an A behind a CDN that injects headers, while the app subdomain (served by the origin) sends none of them.