Security Headers Checker
This free security headers checker grades a website's HTTP security headers from A+ to F and gives you ready-to-paste fixes for Apache and nginx.
How the grade is worked out
We score six headers out of 95 points: HSTS (25), Content-Security-Policy (25), clickjacking protection with X-Frame-Options or CSP frame-ancestors (15), X-Content-Type-Options (10), Referrer-Policy (10) and Permissions-Policy (10). Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy add a bonus of up to 5.
A CSP that allows 'unsafe-inline' or 'unsafe-eval' loses points, and so does a Server or X-Powered-By header that gives away exact software versions (5 each). 95 or more is A+, then A from 85, B from 70, C from 55, D from 40, and below that F.
How to add security headers
On shared hosting with Apache or LiteSpeed, add the lines we suggest to the .htaccess file in your site's main folder. On nginx, add them to the server block and reload nginx.
Add one header at a time and check your site after each. Content-Security-Policy is the one most likely to break things, so start it in report-only mode, read what it reports, then switch it on.
Frequently asked questions
Will adding these headers break my site?
Most won't. Content-Security-Policy can, because it blocks scripts and styles from sources it doesn't list. Start with Content-Security-Policy-Report-Only and switch to enforcing once nothing important is reported.
Do I still need X-XSS-Protection?
No. Modern browsers have removed that filter. A Content-Security-Policy is the current way to defend against cross-site scripting.
Should I add HSTS preload?
Only when every subdomain works over HTTPS and you're sure you'll keep it that way. Preload builds your domain into browsers, and getting it removed takes months.
Do security headers replace a malware scanner?
No. Headers make attacks harder in the browser, but they don't find malware or vulnerable plugins on your server. That's what a scanner like SiteLock is for.