Security Headers Checker — grade your HTTP headers A+ to F

What HTTP security headers do

Every time a browser loads a page, the server sends a set of response headers along with the HTML. A handful of them are security instructions: they tell the browser which scripts it may run, whether it must always use HTTPS, whether other sites may embed the page, and what it may reveal to third parties. They're free to send, invisible to visitors, and they shut whole classes of attacks — cross-site scripting, clickjacking, SSL stripping — even when something else goes wrong. This checker fetches any URL, follows its redirects, reads the raw headers and grades them A+ to F.

The six headers that carry the grade

Content-Security-Policy (30 points)

The strongest single defence against injected scripts. A CSP lists where scripts, styles, images and connections may come from, and the browser refuses everything else — so a script slipped in through a vulnerable plugin or a compromised third party doesn't run. The checker reviews the policy directive by directive and flags the classic weaknesses:

• 'unsafe-inline' in script-src without a nonce or hash, which lets any injected inline script run;
• 'unsafe-eval', which turns injected text into code;
• wildcards and scheme-only sources such as *, https: or data:, which allow scripts from anywhere;
• allowlisted hosts known to serve JSONP or old AngularJS builds, which attackers use to run code from a "trusted" origin;
• no object-src 'none' and no base-uri, two easy-to-forget gaps that default-src doesn't fully cover.

A policy sent as Content-Security-Policy-Report-Only is detected too. It earns partial credit: it's the right way to start, but it reports problems without blocking anything.

Strict-Transport-Security (20 points)

HSTS tells the browser to use HTTPS for your site from now on, so a visitor's first request can't go out over plain http:// and be intercepted before your redirect arrives. Six months of max-age is the usual minimum; one year with includeSubDomains is the standard recommendation, and the requirement for the browsers' preload list.

X-Frame-Options or frame-ancestors (15 points)

Stops other websites from loading your page inside an invisible frame and tricking visitors into clicking buttons on it (clickjacking). X-Frame-Options: SAMEORIGIN works everywhere; the CSP directive frame-ancestors is the modern replacement and also counts. The old ALLOW-FROM value is ignored by current browsers, so it scores nothing.

Referrer-Policy (15 points)

Decides how much of the current URL is sent to other sites when visitors click a link or the page loads a resource. URLs often carry search terms, account IDs or reset tokens, so strict-origin-when-cross-origin or stricter is recommended; unsafe-url is flagged because it sends everything, everywhere.

X-Content-Type-Options (10 points)

One value, nosniff, stops browsers from second-guessing a file's type — so an uploaded "image" can't be run as a script.

Permissions-Policy (10 points)

Switches off browser features you don't use — camera, microphone, geolocation, payment — so neither injected code nor a third-party widget can ask for them. A policy that grants a feature to every origin with =* loses some credit.

Beyond the six

The report also covers what a real security review would mention: cookies set without Secure and HttpOnly (which costs up to five points), server software and version numbers leaking through Server, X-Powered-By or a generator tag, third-party scripts loaded without Subresource Integrity, mixed http:// content, and headers that are now obsolete — X-XSS-Protection (set it to 0 or drop it), Expect-CT and Public-Key-Pins. Cross-origin isolation headers (COOP, COEP, CORP) are shown for information; they're useful in specific cases rather than a baseline requirement.

How the grade works

Points add up to 100. A+ needs 95 or more with no warnings, A 85, B 70, C 55, D 40 and E 25; anything lower is an F, and so is any page served over plain HTTP, because none of the other headers can protect traffic that's readable in transit. The header checks mirror the ones Monity's security monitoring runs on every check, so what this page flags is what a monitor would alert on if it changed.

Fixing it: copy-ready config

The report ends with the exact lines to add for nginx, Apache, Cloudflare, Netlify or Vercel — only the headers that are missing or wrong, so working settings aren't overwritten. For a site with no Content-Security-Policy, the suggestion is a report-only policy built from the third-party scripts and stylesheets the page already loads. Deploy it, read the violation reports for a week or two (in the browser console, or with a report-to endpoint), allow what's legitimate, give inline scripts a nonce, and then switch the header name to Content-Security-Policy.

Headers are often set in several places — the CDN, the web server, the application, plugins — so scan the pages that matter most rather than only the home page: login, account and checkout pages frequently differ.

Related checks

Security headers sit on top of a valid HTTPS setup; check the certificate, its chain and its expiry with the SSL Certificate Checker. The SEO & AI Visibility Audit reviews the same page for search and AI visibility, and the Redirect Checker confirms every http:// variant lands on HTTPS in one hop.

Headers change. Monity notices.

A deploy, a CDN migration or a plugin update can drop a header without any visible change to the page. Monity re-checks your pages on a schedule and alerts you in email, Slack or Teams when a security header changes or disappears, and its script watch flags new script origins and modified third-party scripts — the kind of change detection PCI DSS 4.0 requires for payment pages (requirements 6.4.3 and 11.6.1). The free plan includes three monitors, forever.