Security header checker
Scan any website's HTTP response headers for HSTS, CSP, X-Frame-Options and more — and get an instant A–F security grade with specific fix suggestions.
Why security headers matter
Security headers are the first line of defense a website can offer its visitors, and they cost nothing to deploy. Strict-Transport-Security forces browsers to use HTTPS on every visit, Content-Security-Policy limits what scripts can run, and X-Frame-Options stops your login page from being framed by a phishing site. Yet most sites ship with only a fraction of the recommended set.
This checker fetches your page from one of our monitoring nodes, inspects the full response header set, and grades each header both on presence and on configuration quality — a one-line HSTS header with max-age=300, for example, scores less than the recommended 180-day minimum.
If you manage many sites, SiteFlux can monitor your headers continuously and alert you the moment a security header disappears from a production response — often the first visible symptom of a misconfigured deploy or a hijacked origin.
Frequently asked questions
What are HTTP security headers?
Security headers are HTTP response directives that tell browsers how to behave when loading your site: enforce HTTPS (Strict-Transport-Security), prevent cross-site scripting (Content-Security-Policy), block clickjacking (X-Frame-Options or frame-ancestors), and more. They are a cheap, high-impact layer of defense.
How is the A–F grade calculated?
Each header contributes a weighted score: HSTS with a max-age of at least 180 days is worth 25 points, CSP 20, clickjacking protection 15, X-Content-Type-Options 15, Referrer-Policy 15 and Permissions-Policy 10. 90+ points is an A, 75+ a B, down to below 15 which is an F.
Do security headers affect SEO?
Indirectly, yes. HTTPS and HSTS are ranking-relevant trust signals, and browsers flag sites without basic protections. More importantly, headers like CSP prevent injected spam content that can get a site removed from search indexes.
Where do I add these headers?
In your web server (Nginx add_header, Apache Header set), your CDN or edge configuration (Cloudflare Transform Rules, Vercel next.config headers), or your application framework. Most headers are one line of configuration.
Checked your headers once? SiteFlux re-checks them 24/7 from multiple locations and alerts you by email, Telegram, SMS or phone call when something changes.
Create a free monitor →