HTTP security headers — read, not guessed
HTTP security headers: raw value, what it means, the one-line fix
Headergrade fetches the URL you give it and reports, header by header, what your server returned: the raw value, what it means, and the one line to change. No score out of 100. No dashboard theatre. The facts, in order of severity.
A bare domain is fine — https:// is assumed. Submitting opens the checker and runs the check.
The whole loop
- 01Type a URL. A bare domain works; the scheme is added for you.
- 02One request is made to it. At most two redirects are followed. Nothing is crawled, nothing is followed, nothing is scanned.
- 03You read what came back. Each of the six security headers is reported: the raw value the server sent, what it means, and the one-line change that would improve it.
- 04You leave. No account, no saved history, no re-check on a schedule, no email. The tool answers when you ask and forgets.
What you get
The tool reports these six security headers when you check a URL — plus every other header the server sent, in a raw dump.
| Header | What it controls |
|---|---|
| Content-Security-Policy | What the browser may load on your pages — scripts, styles, frames, images. The main defence against cross-site scripting (XSS). |
| Strict-Transport-Security | Tells browsers to refuse plain HTTP for your domain and upgrade to HTTPS. |
| X-Content-Type-Options | Stops browsers from guessing a file's type instead of trusting the declared one. |
| X-Frame-Options | Controls whether other sites can embed your pages in frames — the clickjacking control. |
| Referrer-Policy | What the browser sends as the referrer when a visitor leaves your site. |
| Permissions-Policy | Which browser features — camera, microphone, geolocation — your pages may use. |
What this tool is not
- Not a score. A grade you cannot act on is decoration. You get the values and the fix.
- Not a scanner. It fetches only the URL you type. It does not crawl, follow links, or probe your infrastructure.
- Not a monitor. It answers when you ask. No scheduled re-scans, no alerts, no email — nothing runs on a timer.
- Not a store. There are no accounts and nothing is saved. A result exists for the check that produced it.
One platform limit, stated plainly: this checker runs on Cloudflare's network, and Cloudflare will not open a connection back into its own network. Hosts served by Cloudflare — example.com, cloudflare.com, and many others — will report as "could not connect" even when the site is up. That is a limit of the checker, not a finding about your site.