Help Centre

Each security header is classified into one of three states:

• OK — the header was sent with a reasonable value. Review it to confirm.
• Review — the header was sent, but the value needs attention (empty, insecure, or non-standard).
• Missing — the server did not send that header at all. The explanation tells you what an attacker could exploit, and the "one-line change" shows the header to add.

Headers are sorted by severity: missing headers first, then review, then ok.

Headergrade runs on Cloudflare's network. Cloudflare Workers cannot open a TCP connection back into a host that is itself behind Cloudflare — that includes example.com, cloudflare.com and many others.

This is a limit of the checker, not a finding about your site. If your site is behind Cloudflare, try curl -I https://yoursite.com from your own machine instead. Every other result Headergrade produces is reliable.

No. The service has no accounts, no database, no history, and no analytics. The URL you submit is sent to the server for the check and then discarded. The result exists only in the browser tab that produced it. There is no way to look a previous check up.

Six security headers are checked individually:

• Content-Security-Policy — restricts what the browser may load (scripts, styles, frames). The main defence against XSS.
• Strict-Transport-Security — tells browsers to refuse plain HTTP and only use HTTPS.
• X-Content-Type-Options — stops browsers from guessing a file's MIME type.
• X-Frame-Options — controls whether other sites can embed your pages in frames (clickjacking protection).
• Referrer-Policy — controls what the browser sends as the referrer when a visitor leaves your site.
• Permissions-Policy — declares which browser features (camera, microphone, geolocation) your pages may use.

Additionally, every header the server sent is shown in the "All headers received" raw dump at the bottom of the report.

The specific configuration depends on your web server software. Here are common examples:

• Nginx: add add_header directives to the server or location block.
• Apache: use Header set or Header always set in .htaccess or the virtual host config.
• Cloudflare: use the "HTTP Security Headers" section in the dashboard (but note the checker cannot reach your site if it is behind Cloudflare).
• CDN / reverse proxy: check the platform's documentation for custom response headers.

Each header in the report includes a "one-line change" suggestion. The header name and value are the same regardless of server software — only the syntax for setting them differs.

There is no catch. The Free tier ($0) is the entire product today. Nothing on this site can charge you — no payment processor is connected.

A Pro plan is planned with batch checks, saved reports and scheduled re-scans, but it is not yet built. When and if Pro launches, the Free tier will remain available.