What security headers should every website have?

At minimum: Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Content-Type-Options, X-Frame-Options, and Referrer-Policy. These protect against common attacks like XSS, clickjacking, and MIME sniffing.

How is the security grade calculated?

The grade is based on how many of the 7 recommended security headers are present: A (6-7), B (5), C (3-4), D (1-2), F (0).

Why can't I inspect localhost or private URLs?

The inspector fetches URLs from the server side. Only publicly accessible http/https URLs can be inspected.

Tools

HTTP Header Inspector

The fast way to see the response headers any URL returns: the redirect path, a security-header summary, and a plain-English note on every header with a link to its reference page.

Enter a URL to see its response headers, redirect path and a security summary.

Need a deeper scan?

The Header Inspector is the quick view. The Site Verifier goes further: it checks TLS and the HTTP to HTTPS upgrade, HSTS preload readiness, cookie flags and server information leaks. Following a redirect migration? Use the Redirect Auditor for canonical and sitemap checks.

Header Reference

Browse all HTTP headers or read specific guides: Headers & Caching, Authentication, CORS. Use the Cache-Control Builder to compose caching headers or the CORS Debugger to test cross-origin configurations.