Security headers check

Check your security headers, then fix them in minutes.

Security headers tell browsers how to protect your visitors from injected scripts, clickjacking and data leaks. See which ones you’re missing, with lines you can paste into your server or CDN.

Passive scan. Nothing is attacked without your permission.

Headers we check

  • Strict-Transport-Security (HSTS): present, and long enough to matter.
  • Content-Security-Policy: the main defence against injected scripts and card skimmers.
  • X-Frame-Options (or CSP frame-ancestors): stops other sites framing yours for clickjacking.
  • X-Content-Type-Options: nosniff.
  • Referrer-Policy and Permissions-Policy.
  • Cookie flags (Secure, HttpOnly, SameSite) and headers that leak server versions.

A safe starting set

These headers are safe for almost every site. Start here, then add a Content-Security-Policy in report-only mode.

nginx
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

Apache, Cloudflare and WordPress versions are in the security headers guide.

More than a letter

A header grade on its own doesn’t tell you what to do next. HackGrade puts headers in context with HTTPS, software versions, WordPress and email, so you fix the riskiest thing first.

Frequently asked questions

Which security headers matter most?

For most small sites: HTTPS with HSTS first, then X-Content-Type-Options, a frame policy and Referrer-Policy (all low-risk), then a Content-Security-Policy, which takes some testing.

Can security headers break my site?

The basic ones rarely do. A strict Content-Security-Policy can block scripts you rely on, which is why we recommend Content-Security-Policy-Report-Only first.

Is X-XSS-Protection still needed?

No. Modern browsers have removed the XSS filter it controlled. MDN recommends a Content-Security-Policy instead, so we don’t penalise a missing X-XSS-Protection header.

Guides with copy-paste fixes

Guide

Security headers

Copy-paste HTTP security headers for nginx, Apache (.htaccess), Cloudflare and WordPress: HSTS, X-Content-Type-Options, frame protection, Referrer-Policy and Permissions-Policy.

Guide

Content-Security-Policy

Roll out a Content-Security-Policy without breaking your site: start in report-only mode, build an allow-list, then enforce. Examples for nginx, Apache and WordPress.

Guide

HSTS

What HSTS does, why a short max-age first, when to use includeSubDomains and preload, with copy-paste lines for nginx, Apache and Cloudflare.

More free checks

Free · Instant · No sign-up

Find out your grade before someone else does.

Passive scan. Nothing is attacked without your permission.

Free to start. Paid plans from $12 a month, or a one-time report for $29. See pricing

This page is in English. Translations are on the way.