Security Headers Checker
Security Headers Checker is a free tool that grades your website A to F on the browser settings that protect visitors, with the exact line to add for each.
- Free
- No sign-up
- Checks a live page
Security headers are short instructions your website sends with every page, telling browsers how to protect your visitors — from fake copies of your site, stolen logins and injected scripts. Most small business websites are missing several. This checker fetches your page once, grades it from A to F, explains in plain words what each header protects against, and gives you the exact line to add.
Your workspace
Guide
How to use it
- 1Type your website address.
- 2Press Check security. We fetch your page once and also check that the http:// version sends people to the secure https:// one.
- 3Read the grade, then work down the list. Red items are missing protections; amber ones could be stronger.
- 4Copy each suggested line to your developer, hosting panel, .htaccess file or a Cloudflare rule. Then run the check again.
What the results mean
- HTTPS and HSTS
- HTTPS encrypts the connection. HSTS tells browsers to always use HTTPS for your site, even if someone types or clicks an http:// link.
- Content-Security-Policy (CSP)
- A list of places your pages may load scripts and files from. If a hacker slips in a script from somewhere else, the browser refuses to run it.
- Clickjacking
- A trick where your page is hidden inside another site so visitors click things they cannot see. X-Frame-Options or frame-ancestors stops it.
- Secure cookies
- Cookies can hold logins. The Secure, HttpOnly and SameSite flags stop them leaking over plain http, being read by scripts, or being sent by other sites.
Common questions
Do security headers affect my Google ranking?
HTTPS is a small ranking signal; the other headers are not. But they protect your visitors and your reputation, and a hacked site loses rankings quickly.
Can adding these headers break my website?
Most cannot. Content-Security-Policy can block things your site needs if it is too strict, so ask your developer to test it first, or start with the report-only version.
How is this different from the HTTP header checker?
The HTTP header checker lists the headers your page sends. This tool scores the security ones, explains what each protects against and gives you the line to add.
Where do I add these headers?
It depends on your host: a hosting control panel, a WordPress security plugin, your .htaccess file, or a Cloudflare Transform Rule. Send the suggested lines to whoever manages your website.
Guides on this topic
- Privacy Policy for a Website in India: What to IncludeWhy a website that collects phone numbers or emails needs a privacy policy, the ten things it must say, and what India’s DPDP Act expects of you.
- Website Security Basics: HTTPS, SSL and Staying SafeWhat HTTPS and an SSL certificate do, how to get one free, and the updates, passwords and backups that stop most small business websites being hacked.