Seven headers protect every page. Most sites never check what theirs actually say.

Headergrade fetches a URL and reports every HTTP security header your server sends — with plain-language explanations of what each one does and the one-line change to fix it. No scores, no scare meters, no signup.

Scan your site See plans

What Headergrade checks

Content-Security-Policy

Controls what resources the browser can load. A missing or permissive policy is the most common way XSS succeeds.

Strict-Transport-Security

Tells the browser to always use HTTPS. Without it, a single HTTP request can leak cookies or redirect to a lookalike.

X-Content-Type-Options

Prevents MIME-type sniffing. When absent, a malicious PDF uploaded to a photo gallery can be rendered as HTML.

X-Frame-Options

Stops your page from being embedded in an iframe on another domain — the defence against clickjacking.

Referrer-Policy

Controls what URL data is sent when a user clicks a link to another site. Too much leakage exposes private paths.

Permissions-Policy

Restricts which browser APIs (camera, microphone, geolocation) the page and its frames can access.

Cache-Control

Governs how and for how long browsers and proxies cache your content. A missing directive can allow stale or sensitive content to be served from a shared cache.

Plus everything else

Every header the server sends is listed. Headergrade does not cherry-pick — if it is there, you will see it.

How it works

Enter a URL. Headergrade fetches it server-side (using a Cloudflare Worker), follows up to two redirects, and returns every HTTP response header exactly as the server sent it. For each of the seven key security headers, you get a plain-language explanation of what it does, whether the current value is effective, and the specific directive to change.

That is all it does. No accounts, no stored history, no scheduled re-scans. This tool answers when you ask it, and it tells you honestly what it received.

What Headergrade is not

Not a compliance scanner. Headergrade does not score, certify, or assert compliance with any standard or regulation.

Not a penetration tool. It fetches one URL at a time and reports what it receives. It does not crawl, follow links, or test for vulnerabilities — it reads headers.

Not a monitoring service. There is no backend database, no user accounts, no email alerts, and no scheduled re-scans. Check your site when you want to check it.