01What are security headers for?
With every response, a site can send security headers that instruct the browser: only run authorized scripts (CSP), refuse unencrypted HTTP (HSTS), forbid framing (anti-clickjacking)… They are free protections, honored by every modern browser, that neutralize whole classes of attacks — XSS, interception, click hijacking.
This tool reads the headers returned by the URL (after its redirects, followed like in our redirect tracer) and grades the configuration from A+ to F. To see the headers your browser sends, use our HTTP headers tool.
02The six protections checked
- CSP
- Content-Security-Policy: an allowlist of sources for scripts, styles, images… The strongest defense against XSS, and the most demanding to configure.
- HSTS
- Strict-Transport-Security: forces HTTPS on the browser for max-age seconds. Against SSL stripping; 6 months minimum recommended.
- nosniff
- X-Content-Type-Options: nosniff: forbids the browser from guessing a file's type, preventing a fake “image.jpg” containing script from running.
- Clickjacking
- X-Frame-Options or CSP frame-ancestors: controls who may load the site in an iframe, against click hijacking.
- Referrer
- Referrer-Policy: limits what the referring URL reveals to third-party sites (parameters, internal paths).
- Permissions
- Permissions-Policy: cuts camera / microphone / geolocation access for third-party iframes (ads included).
03From the command line
The same URL as this page answers in plain text, and the JSON API returns each check structured (open CORS) — pluggable into a CI to watch your deployments:
$ curl "its-my-ip.com/security?url=https://exemple.fr" grade: B content-security-policy: missing strict-transport-security: ok max-age=31536000 $ curl "its-my-ip.com/api/security?url=https://exemple.fr" { "grade": "B", "checks": { "csp": { "status": "err" }, … } }
04Frequently asked questions
What grade should my site aim for?
A or A+ for any site with user accounts or payments. A static brochure site can live with a B, but the missing headers (nosniff, Referrer-Policy, X-Frame-Options) take five minutes to add — there is little reason to skip them. Only the CSP requires real inventory work on your sources.
Where do I configure these headers?
At the web server level (nginx: add_header, Apache: Header set), in the framework (helmet for Node.js, SecurityMiddleware for Django), or at the CDN (Cloudflare Transform Rules, _headers files on Netlify/Vercel). One place is enough: avoid declaring them twice, contradictory values create subtle bugs.
Why is my CSP marked as “improvable”?
Because it contains unsafe-inline or unsafe-eval without a nonce or hash: any script injected into the page can then run, which defeats the CSP's main purpose. The modern fix is a random per-response nonce (script-src 'nonce-…') or sha256 hashes of your legitimate inline scripts.
Can enabling HSTS break my site?
Yes, if a subdomain is not served over HTTPS and you use includeSubDomains: the browser will refuse to connect to it until max-age expires. Start with a short max-age (300), verify all your subdomains, then raise it progressively to 6 months or 1 year. Rolling back is slow: browsers remember the directive.
Are these headers enough to secure a site?
No — they are a defense-in-depth layer on the browser side. They fix neither an SQL injection, nor broken authentication, nor a vulnerable dependency. But they turn many exploitable flaws into inert ones, at near-zero cost: the best effort-to-protection ratio on the web.
05More tools
Web & SEO
Page auditAudit a web page: security, SEO, performance — score /100 HTTP headersSee the HTTP headers your browser sends Link previewPreview a page's share cards (Open Graph, Twitter Cards) Robots.txt testerTest a site's robots.txt: are Googlebot, GPTBot, ClaudeBot… allowed? TLS certificatesList a domain's SSL/TLS certificates and their expiry RedirectsFollow a URL's redirect chain (301, 302…) Site down?Check whether a website is down for everyone or just for you User agentDisplay and decode your user agent (browser, OS, device)My IP & network — BGP / RPKI · Subnet · Port check
DNS & domains — DNS lookup · DNS propagation · Whois · Punycode / IDN
Email — Email score · Email check · Email headers · Blacklist · DMARC generator · DKIM key
Privacy & passwords — WebRTC leak · Passwords · Password leak
Dev & encoding — JWT decoder · Unix timestamp · Cron expressions · Base64 · MD5/SHA digests · UUID generator