Free tool
HTTP Headers Checker
Inspect every HTTP response header for any website and get an A-F security grade with plain-English explanations of what is missing and why it matters.
Why response headers matter
Headers are instructions your server sends with every page: cache this, encrypt that, never embed me in an iframe. Browsers enforce them, and search engines read some of them. A missing Strict-Transport-Security leaves users open to downgrade attacks; a missing X-Frame-Options makes clickjacking trivial; a chatty Server header announces your exact software version to anyone scanning for known exploits.
What we grade
The checker follows redirects to the final URL, captures the response and grades six headers security scanners agree on: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options (or its CSP equivalent), Referrer-Policy and Permissions-Policy. Each is explained in one sentence, so you know what a miss actually risks rather than just seeing red marks.
Below the grade you get the complete raw header list, the same data curl -I would show, useful for debugging caching, compression, cookies and CDN behaviour.
Grades in the wild
Most small-business sites score D or F, not because their owners are careless but because default hosting configs simply do not set these headers. The fix is a few lines in the server config, and every site we build or migrate ships with an A-grade set out of the box.
Frequently asked questions
My site got an F. Is it hacked?
No. The grade measures preventive protection, not infection. An F means the standard security headers are absent, which is the default on many hosts. It is worth fixing, and the fix is quick.
Will these headers improve my SEO?
Indirectly. HTTPS is a confirmed ranking signal and headers like HSTS strengthen it. Mostly they protect users, which protects your reputation and prevents the blacklisting that genuinely destroys rankings.
Why do you hide Set-Cookie values?
Cookie contents can include session identifiers. The checker confirms cookies are being set but never displays or stores their values.
Can you fix my headers for me?
Yes. Header hardening is included free in every cloning, migration and restoration project, or as a small standalone fix. Send your grade over and we will quote it.
Ready to get an exact copy of any website?
Send us a link and get a free, no-obligation estimate within one business day.
Get a free quote