Security Headers

Grade a website's HTTP security headers (HSTS, CSP, X-Frame-Options and more), follow its redirects and see how to fix each one.

A handful of HTTP response headers tell browsers to switch on protections they otherwise leave off: always use HTTPS (HSTS), only run scripts from approved places (CSP), refuse to be framed by other sites (clickjacking), and never guess file types. They cost nothing to add and block whole classes of attacks. This fetches a page the way a browser would, follows its redirects and grades the headers it sends, with what each one does and how to fix it. Only the headers are read; the page itself is never downloaded or displayed.