HTTP Security Headers Analyzer
Inspects and grades a site's security headers (HSTS, CSP, X-Frame-Options and more).
Frequently Asked Questions
What do HTTP security headers do?
They are instructions the server sends to the browser to help prevent attacks like script injection (XSS), clickjacking and information disclosure.
Which headers are the most important?
HSTS and Content-Security-Policy have the biggest impact, followed by X-Content-Type-Options, X-Frame-Options and Referrer-Policy.
What exactly does HSTS do?
It tells the browser to always open the site over HTTPS only, even if the user types http, preventing downgrade attacks.