What this tool checks
HTTP security headers tell the browser how to protect your users. This scanner grades the ones that matter most: HSTS to enforce HTTPS, Content-Security-Policy to limit what can run on the page, X-Frame-Options to block clickjacking, X-Content-Type-Options to stop MIME sniffing, Referrer-Policy, Permissions-Policy, and more. Each check shows the value it found, why it matters, and the exact header to add when something is missing.
Frequently asked questions
Which header should I fix first?
Start with HSTS and Content-Security-Policy. They carry the most weight and close the biggest gaps. The scorecard orders each check by impact so you can work down the list.
Will adding these headers break my site?
Most are safe to add immediately. Content-Security-Policy needs care because a strict policy can block scripts and styles you rely on, so roll it out in report-only mode first and tighten from there.
What is a good grade?
An A or A+ means the important headers are present and well configured. A C or below usually means HSTS or CSP is missing. The recommendations show precisely what to add to move up.