Security Headers Checker
Test the HTTP security headers of any website and get a grade from A+ to F, with a plain-language explanation and a copy-ready fix for every missing header.
What this security headers test checks
The checker fetches your URL exactly like a browser, follows redirects to the final page, and inspects the response headers. Six protections are graded: Strict-Transport-Security (forces HTTPS), Content-Security-Policy (the main defense against cross-site scripting), X-Frame-Options or frame-ancestors (blocks clickjacking), X-Content-Type-Options (stops MIME sniffing), Referrer-Policy (controls what URLs you leak to other sites) and Permissions-Policy (switches off browser features you do not use).
It also flags information leaks that help attackers, like X-Powered-By and Server headers that advertise exact software versions, and deprecated headers such as X-XSS-Protection that should be removed. Each finding comes with the exact header line to add or remove, so fixing a failing grade usually takes minutes in your server config or CDN rules.
Security headers FAQ
What are HTTP security headers?
Security headers are instructions a web server sends with every response that tell the browser how to protect the page: force HTTPS (Strict-Transport-Security), restrict where scripts load from (Content-Security-Policy), block framing (X-Frame-Options), stop MIME sniffing (X-Content-Type-Options), and limit referrer leakage and browser features. They cost nothing and block whole classes of attacks.
Which security headers should every website have?
Six matter most: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options (or a CSP frame-ancestors directive), X-Content-Type-Options: nosniff, Referrer-Policy, and Permissions-Policy. This checker grades exactly those six and explains how to add each one.
What is a good security headers grade?
A or A+ means all core protections are in place. B or C means the basics exist but something important like CSP is missing or weakened. D and F mean the site relies entirely on browser defaults. Most WordPress sites score D or F out of the box because no plugin or server config sets these headers.
How do I add security headers to WordPress?
Three ways: in your web server config (Apache .htaccess or the nginx server block), in your CDN or proxy (Cloudflare Transform Rules can add headers for free), or with a security plugin. Server or CDN level is best because the headers then cover every response, including static files.
Does Content-Security-Policy break websites?
A strict CSP can break inline scripts and third-party embeds if you deploy it blind. The safe path is to start with Content-Security-Policy-Report-Only, watch the violation reports, then enforce. The other five headers in this check are safe to add immediately on almost any site.
Do security headers affect SEO?
Indirectly, yes. HTTPS with HSTS is part of the secure-site signals Google uses, and headers that stop your site being framed or injected protect you from the kind of compromise that gets sites flagged or blocklisted, which is catastrophic for rankings.
More free tools: Redirect Checker · SSL Checker · Bot User-Agent Lookup · SERP Snippet Preview