Security headers checker
Scan a URL's HTTP security headers and get a grade. Every header is checked for presence and for the values that quietly undo it.
Related tools: Is my website down? · HTTP headers checker · Redirect checker · HTTP status checker · TTFB test · Uptime calculator · All free tools
The policies a page tells the browser to enforce
HTTP security headers are instructions a server sends with a page that tell the browser what to refuse: plain-HTTP connections, scripts from unexpected places, being framed by another site, guessing file types. They cost nothing to add and close whole classes of attack. This tool requests the URL from Cloudflare's network, follows redirects, and checks the six headers that matter most, weighting HSTS and Content-Security-Policy most heavily, then flags headers that reveal server software versions.
Headers set today can vanish with the next CDN rule or framework upgrade. Upcheck watches the more basic failure, requesting every website every 5 minutes and alerting your team when it stops answering.
Three steps, no signup
- 01
Enter a URL
Usually your home page; security headers should be set site-wide.
- 02
We request it and read the headers
Redirects are followed and the headers of the final response are scanned.
- 03
Each header is graded
Pass, warning, or fail with the reason, a score out of 100, and a letter grade from A+ to F.
Frequently asked questions
What are HTTP security headers?
Response headers that switch on protections built into browsers. Strict-Transport-Security makes browsers use HTTPS for your site from then on. Content-Security-Policy restricts where scripts, styles, and frames may load from, which blunts cross-site scripting. X-Content-Type-Options stops browsers treating a file as a type it isn't. X-Frame-Options stops other sites framing your pages for clickjacking. Referrer-Policy limits what URL leaks to other sites, and Permissions-Policy turns off browser features the page doesn't use.
How do I add security headers?
Wherever responses are produced or pass through. In nginx, add_header lines in the server block; in Apache, Header set in the virtual host or .htaccess; on Cloudflare, a Transform Rule that sets response headers; on Vercel or Netlify, the headers section of the project config; in most frameworks, a middleware. Set them at one layer only, so two layers don't send conflicting values.
Why does my Content-Security-Policy only get a warning?
Because it allows 'unsafe-inline' or 'unsafe-eval' for scripts. Those keywords let inline or dynamically evaluated scripts run, which is exactly what an XSS attack injects, so the policy stops most of what it was added to stop. Replace inline scripts with files, or allow specific inline scripts with nonces or hashes, then remove the unsafe keywords.
Do I need X-Frame-Options if I have CSP frame-ancestors?
Not for modern browsers: frame-ancestors supersedes X-Frame-Options, and this checker counts either. Sending both does no harm and covers old browsers. If you need to allow framing by specific sites, only frame-ancestors can express that; X-Frame-Options' ALLOW-FROM value was never widely supported.
Why is revealing the server version a problem?
A header like Server: Apache/2.4.29 or X-Powered-By: PHP/7.2 tells anyone scanning the internet exactly which known vulnerabilities to try. Hiding it doesn't fix an outdated server, but it stops you being matched in bulk scans. Most servers can drop the version with one setting, such as server_tokens off in nginx or ServerTokens Prod in Apache.
Is this security headers checker free?
Yes. No account and no limit on scans by hand; scripted use is rate limited. The grade covers response headers only: it doesn't test the application, the TLS configuration, or the certificate. For the certificate, use the SSL certificate checker.
Headers protect the page. Monitoring makes sure the page is there.
Add your websites to Upcheck and get alerted by email, Slack, Discord, Teams, or webhook the moment one goes down.