What security headers should every website have?

At minimum: Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Content-Type-Options, X-Frame-Options, and Referrer-Policy. These protect against common attacks like XSS, clickjacking, and MIME sniffing.

How is the security grade calculated?

The grade is based on how many of the 7 recommended security headers are present: A (6-7), B (5), C (3-4), D (1-2), F (0).

Why can't I inspect localhost or private URLs?

The inspector fetches URLs from the server side. Only publicly accessible http/https URLs can be inspected.

Tools

HTTP Header Inspector

Enter any URL to fetch and analyze its HTTP response headers. Get a security grade, see which headers are present or missing, and click any header for its full reference.

Header Reference

Browse all HTTP headers or read specific guides: Headers & Caching, Authentication, CORS. Use the Cache-Control Builder to compose caching headers or the CORS Debugger to test cross-origin configurations.