Security headers
Rate your website's security headers from A to F, with an explanation and suggestion for each header.
About this tool
Security headers are rules the server sends to the browser. They control things like always serving the page over HTTPS, where scripts may be loaded from and whether other sites can embed the page in a frame.
The tool fetches the page and checks seven headers: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options or frame-ancestors, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and Cross-Origin-Opener-Policy. Each header contributes to a score, and the total gives a rating from A to F.
For each header that is missing or weak, you get an explanation and a suggested value. Start with HSTS, X-Content-Type-Options and Referrer-Policy, as these rarely cause problems. CSP requires more work, since too strict a rule can block scripts the page depends on.
Frequently asked questions
How do I add security headers?
On web hosting with Apache or LiteSpeed, add lines to .htaccess, for example Header always set X-Content-Type-Options "nosniff". In WordPress there are also plugins that handle this.
Can security headers break my site?
Most won't. Content-Security-Policy can block scripts and styles if the rule is too strict. Try it first as Content-Security-Policy-Report-Only.
Do I need X-Frame-Options if I have CSP?
frame-ancestors in CSP replaces X-Frame-Options in modern browsers. Many sites send both to protect older browsers as well.
Is the rating the same as a security audit?
No. The rating only shows which headers the server sends. Updates, passwords and backups are at least as important.