Free agency tools / Security Headers Checker
Grade any site's security headers
The six HTTP response headers that harden a site against XSS, clickjacking and MIME attacks — graded A+ to F, with the exact Nginx or Apache line to paste for every one you're missing.
Results for
–
0 / 100
How it works
- 1Enter any URL — we fetch it and read its HTTP response headers.
- 2Six headers are graded and weighted (HSTS and CSP count most), giving an A+–F score.
- 3For every missing header you get the recommended value plus a copy-ready Nginx and Apache line.
Frequently asked
Why do HSTS and CSP matter most?
HSTS forces HTTPS and CSP is the single strongest defence against cross-site scripting, so they carry the most weight — the same emphasis securityheaders.com uses.
Is a missing CSP a real problem?
It's the most valuable header to add and the hardest to get right — start with a strict policy and loosen it per resource. Test on staging before shipping.
Do these headers slow the site down?
No — they're a few bytes on each response. There's no performance cost to setting them correctly.
