AES Encryption Explained: How It Works and Why It Matters
Jun 23, 2026
Security Headers Checker
Analyze HTTP security headers of any website including CSP, HSTS, X-Frame-Options, and CORS.
- Home
- Hash & Security
- Security Headers Checker
Frequently Asked Questions
What are HTTP security headers?
HTTP security headers are directives sent by a web server in the HTTP response that instruct the browser how to behave regarding security. Headers like CSP (Content-Security-Policy), HSTS (Strict-Transport-Security), and X-Frame-Options help protect against common attacks such as XSS, clickjacking, and protocol downgrade attacks. A properly configured set of security headers significantly reduces your website's attack surface.
What grade should my website aim for?
You should aim for a grade A (90–100%). This means all critical security headers are present and configured correctly. Grade B (70–89%) is acceptable but has room for improvement. Grades below C (below 50%) indicate significant security gaps that should be addressed promptly. This checker evaluates headers like HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and CORS.
How do I fix missing security headers on my site?
Add the missing headers to your web server configuration. For Apache, use Header set directives in .htaccess or httpd.conf. For Nginx, use add_header directives. For cloud platforms like Cloudflare or AWS, you can add headers through the dashboard or origin server configuration. Each header's recommendation column explains exactly what to add and why.
What is Content Security Policy (CSP) and why is it important?
CSP is a security header that helps prevent Cross-Site Scripting (XSS), data injection, and other code injection attacks. It allows you to specify which sources of content (scripts, styles, images, fonts, etc.) the browser should allow to load on your page. A well-crafted CSP can block malicious scripts even if an attacker finds a way to inject code into your site.
Does this tool store the URLs I check?
No. This tool fetches the headers from the provided URL on the server side to perform the analysis. The URL and results are not stored, logged, or shared with any third party. Once you leave or refresh the page, the results are gone.
Last updated: 24 Jun 2026
Blog
Latest from Our Blog
CSS Gradient Generator: Create Stunning Gradients for Your Website
Jun 23, 2026
Diff Checker: How to Compare Text and Files Effectively
Jun 23, 2026
JSON Validation: How to Validate and Fix JSON Data
Jun 23, 2026
Regex Testing: How to Test and Debug Regular Expressions
Jun 23, 2026
SSL Certificate Checker: How to Verify SSL/TLS Certificates Online
Jun 23, 2026