01What are security headers for?
With every response, a site can send security headers that instruct the browser: only run authorized scripts (CSP), refuse unencrypted HTTP (HSTS), forbid framing (anti-clickjacking)… They are free protections, honored by every modern browser, that neutralize whole classes of attacks — XSS, interception, click hijacking.
This tool reads the headers returned by the URL (after its redirects, followed like in our redirect tracer) and grades the configuration from A+ to F. To see the headers your browser sends, use our HTTP headers tool.
02The six protections checked
- CSP
- Content-Security-Policy: an allowlist of sources for scripts, styles, images… The strongest defense against XSS, and the most demanding to configure.
- HSTS
- Strict-Transport-Security: forces HTTPS on the browser for max-age seconds. Against SSL stripping; 6 months minimum recommended.
- nosniff
- X-Content-Type-Options: nosniff: forbids the browser from guessing a file's type, preventing a fake “image.jpg” containing script from running.
- Clickjacking
- X-Frame-Options or CSP frame-ancestors: controls who may load the site in an iframe, against click hijacking.
- Referrer
- Referrer-Policy: limits what the referring URL reveals to third-party sites (parameters, internal paths).
- Permissions
- Permissions-Policy: cuts camera / microphone / geolocation access for third-party iframes (ads included).
03From the command line
The same URL as this page answers in plain text, and the JSON API returns each check structured (open CORS) — pluggable into a CI to watch your deployments:
$ curl "its-my-ip.com/security?url=https://exemple.fr" grade: B content-security-policy: missing strict-transport-security: ok max-age=31536000 $ curl "its-my-ip.com/api/security?url=https://exemple.fr" { "grade": "B", "checks": { "csp": { "status": "err" }, … } }
04Frequently asked questions
What grade should my site aim for?
A or A+ for any site with user accounts or payments. A static brochure site can live with a B, but the missing headers (nosniff, Referrer-Policy, X-Frame-Options) take five minutes to add — there is little reason to skip them. Only the CSP requires real inventory work on your sources.
Where do I configure these headers?
At the web server level (nginx: add_header, Apache: Header set), in the framework (helmet for Node.js, SecurityMiddleware for Django), or at the CDN (Cloudflare Transform Rules, _headers files on Netlify/Vercel). One place is enough: avoid declaring them twice, contradictory values create subtle bugs.
Why is my CSP marked as “improvable”?
Because it contains unsafe-inline or unsafe-eval without a nonce or hash: any script injected into the page can then run, which defeats the CSP's main purpose. The modern fix is a random per-response nonce (script-src 'nonce-…') or sha256 hashes of your legitimate inline scripts.
Can enabling HSTS break my site?
Yes, if a subdomain is not served over HTTPS and you use includeSubDomains: the browser will refuse to connect to it until max-age expires. Start with a short max-age (300), verify all your subdomains, then raise it progressively to 6 months or 1 year. Rolling back is slow: browsers remember the directive.
Are these headers enough to secure a site?
No — they are a defense-in-depth layer on the browser side. They fix neither an SQL injection, nor broken authentication, nor a vulnerable dependency. But they turn many exploitable flaws into inert ones, at near-zero cost: the best effort-to-protection ratio on the web.