Help Centre

Frequently asked questions, getting-started guide, and known limitations for Headergrade.

Getting Started

Headergrade is a diagnostic tool that fetches any public HTTPS URL and reports every HTTP response header your server sends. For the seven most important security headers, it provides a plain-language explanation of what each one does, whether the current value is effective, and the exact change you need to make.

Go to the scan page. No signup or account needed.
Enter your URL. If you omit the scheme, https:// is added automatically. Private or internal hosts (e.g. localhost, 192.168.x.x) are rejected for security reasons.
Click "Scan". Headergrade fetches the URL server-side (via Cloudflare Workers), follows up to two redirects, and returns the headers as received.
Read the results. Each of the seven key security headers gets its own card showing the raw value, a status (Present and scoped / Present, review value / Missing), and what it means. Use the "Show all headers" button to see every header the server actually sent.
Apply the fix. Each card includes a recommended header value you can copy straight into your server configuration or CDN settings.

That is all it does. Headergrade answers when you ask it. There are no accounts, no stored history, no scheduled re-scans. If you want to check again tomorrow, you scan again tomorrow.

Frequently Asked Questions

What headers does Headergrade check?

Seven key security headers get detailed explanations with status indicators and fix recommendations:

Content-Security-Policy — Controls what resources the browser can load. The most common defence against cross-site scripting (XSS).
Strict-Transport-Security (HSTS) — Forces the browser to always connect over HTTPS. Without it, an initial HTTP request can leak cookies or redirect to a lookalike.
X-Content-Type-Options — Prevents the browser from MIME-type sniffing. Absent = a malicious file upload could be rendered as HTML.
X-Frame-Options — Stops your page being embedded in an iframe on another site (clickjacking defence).
Referrer-Policy — Controls what URL data is sent when a user clicks a link. Too much leakage exposes private paths.
Permissions-Policy — Restricts which browser APIs (camera, microphone, geolocation) the page and its frames can use.
Cache-Control — Governs how browsers and proxies cache your content. Missing directives can allow stale or sensitive content to be served from a shared cache.

Plus every other header your server sends is listed in the "Show all headers" table. Headergrade does not cherry-pick — if it is there, you will see it.

How do I interpret the scan results?

Each header card shows one of four status levels:

Present and scoped (green) — The header is set with a value that provides meaningful protection.
Present, review value (amber) — The header is present but the value may be too permissive, incomplete, or worth auditing.
Missing (red) — The header is absent from the response altogether. Your site is missing that layer of protection.
Neutral (grey) — The header is informational or its absence is not a security concern (e.g. non-security headers shown in the full list).

Headergrade does not calculate a score out of 100. A grade nobody can act on is decoration — instead, each card tells you exactly which directive to change and why.

Why did my scan fail or return unexpected results?

Several known causes:

Private or internal hosts are rejected. Headergrade will not scan localhost, 127.0.0.1, 10.x.x.x, 192.168.x.x, 172.16-31.x.x, or other RFC 1918 addresses.
No scheme enters an infinite loop. If the URL does not begin with http:// or https://, Headergrade prepends https://. If the server does not respond on HTTPS, the scan will time out.
Cloudflare-on-Cloudflare limitation. Headergrade runs on Cloudflare Workers. When scanning a site that is also behind Cloudflare, the Worker's outbound request is intercepted by Cloudflare's own network, so the headers received reflect what Cloudflare returns to its own infrastructure, not what a browser would see from the open internet. This is a platform limitation, not a bug in the scan.
Redirect loops or too many hops. Headergrade follows up to two redirects. If the URL chains more redirects than that, the scan stops at the last hop followed.
Unreachable or slow sites. The Worker has a timeout. If the target server does not respond within that window, the scan returns an error.

Is Headergrade a security audit? Does it certify compliance?

No. Headergrade is a diagnostic tool, not a compliance scanner or penetration tool. It does not:

Score, certify, or assert compliance with any standard or regulation (PCI DSS, SOC 2, ISO 27001, HIPAA, GDPR, etc.)
Crawl your site, follow links, or test for actual vulnerabilities
Guarantee that the presence of a header means your application is secure

A correctly configured Content-Security-Policy is one layer of defence, not a clean bill of health. Always pair header checks with proper application security testing.

Does Headergrade store my data?

No. Headergrade does not have a database. There are no user accounts, no cookies, no analytics tracking, and no stored scan history. The URL you enter is processed in memory by a Cloudflare Worker and discarded after the result is returned to your browser. See the Privacy Policy for full details.

Is there a limit on how many scans I can run?

No. The Free tier (€0/month) includes unlimited scans with no signup required. There is no rate limit on the app page. If the service experiences abuse in the future, the operator may introduce rate limiting, but it will apply evenly to all users and be documented here.

When will Pro features be available?

Pro features (scan history, scheduled re-scans, email alerts, team workspaces, API rate-limit increases) are planned but not yet built. The backend infrastructure required — a database, user authentication, a scheduled job runner, and an email sender — does not exist yet. The pricing page shows these as planned items. There is no timeline for delivery, and no way to purchase Pro today.

The Free tier will remain available indefinitely with no feature degradation.

Can I use Headergrade programmatically / via API?

Headergrade does not have a public API endpoint. The scan tool is the only interface. An API may be offered with the Pro tier in future, but is not available today.

Known Limitations

Honest about what this product is. Headergrade is an early-stage tool. The following are deliberate limitations, not bugs:

Cloudflare-on-Cloudflare blind spot. As described above, scans of sites behind Cloudflare return headers as seen by Cloudflare's internal network, not the open internet. This is a fundamental platform constraint of Workers.
No redirect history beyond 2 hops. If a URL chain has 3+ redirects, the scan stops after 2 and reports only the headers from the last followed hop.
No HTTPS upgrade simulation. The scan always requests the exact URL provided (with https:// prepended if no scheme was given). It does not attempt to fetch the HTTP version and compare headers.
No header-value validation. Headergrade reports exactly what the server sends. It does not check whether a CSP directive is syntactically valid, whether an HSTS max-age is long enough, or whether a Permissions-Policy origin is whitelisted correctly. The explanations flag common issues but are not a substitute for manual review.
No comparison or diff. There is no way to compare scans over time because no data is stored. Each scan is a fresh, independent check.
No user accounts. There is no login, no saved preferences, no scan history. Every visit is anonymous.
No payment processor. Pro subscriptions cannot be purchased. The checkout form on the pricing page is a front-end demo only.
No email infrastructure. Headergrade cannot send alerts, receipts, reminders, or any other email. No contact inbox exists — see below.

How to Contact Us

No support inbox has been established yet. The operator has not registered a legal entity or set up a mailbox for this service. There is no email address to write to, no ticket system, and no live chat.

Because Headergrade is a simple, stateless tool with no accounts, most questions are answered by this page. If you have found a genuine bug or have a feature suggestion:

Check the Terms of Service and Privacy Policy first.
If the issue is about a specific scan result, re-run the scan and confirm the behaviour is reproducible.
When a contact mechanism is established (a repository issue tracker, a support email, or a contact form), it will be linked from this page and from the site footer. Until then, this page is the complete source of help.

You are reading the Help Centre for Headergrade — a free HTTP security header diagnostic tool. This page was last updated: 8 August 2026.