Security Headers Checker
Check whether a website is sending the HTTP security headers that protect against clickjacking, XSS, and downgrade attacks — and get a letter grade.
Why Security Headers Matter
HTTP security headers are one-line instructions your server sends telling browsers how to treat your site — whether to allow it inside a frame, whether to run only HTTPS, and which sources of scripts and styles are trusted. Most are entirely free to add (a few lines in your server or CDN config) and close off classes of attacks like clickjacking and cross-site scripting without changing how your site looks or works.
Where to Add These Headers
If you're on Vercel, Netlify, or Cloudflare, these headers can be set in a config file or dashboard rule without touching application code. On a traditional server (Apache/Nginx), they go in your virtual host config. Start with Content-Security-Policy in report-only mode so you can see what it would block before enforcing it.