Free security headers checker
Browsers can protect the people reading your site, but only if your server asks them to. See which security headers your site sends, a grade from A to F, and the exact line to add for each fix.
We only read what any browser can see. Nothing on your site changes.
Reading your headersβ¦
What to fix first
Worst first. Each one says what it means for your visitors and how to fix it.
Every header your site sends
Exactly what your homepage answered, as a browser receives it.
How the request was answered
Each redirect on the way to your homepage.
Get help with what we found
Want us to fix this for you?
Tell us what the tool found and we will tell you what it takes to fix it. The first call is free.
Get tips like these by email
Practical advice on getting found, getting faster and getting more enquiries, plus news and offers about WPfoss products. No more than once a fortnight, and one click to leave.
Optional. You do not need to sign up to see your results.
Want us to fix this for you? The first call is free.
Six headers that protect your visitors
Every time someone opens a page, your server sends a few lines of instructions along with it. Six of them tell the browser how to protect the person reading:
- Strict-Transport-Security makes browsers use HTTPS every time, so a visitor on public Wi-Fi is never sent the plain http version.
- Content-Security-Policy lists where scripts may come from. If a hacked plugin injects a script, the browser refuses to run it.
- X-Frame-Options (or the CSP rule frame-ancestors) stops other sites showing your page inside theirs to trick visitors into clicking your buttons.
- X-Content-Type-Options stops the browser treating an uploaded file as a script.
- Referrer-Policy limits what other sites learn about the page a visitor came from.
- Permissions-Policy switches off the camera, microphone and location for anything embedded in your pages.
Two more things we check: headers such as X-Powered-By: PHP/7.4 that tell an attacker exactly which old software to target, and cookies sent without their Secure and HttpOnly flags.
Most of them take minutes to add. If you would rather we did it, talk to us: our website maintenance plans include security monitoring and hardening. Check your certificate too with our SSL checker.
Questions people ask
What are security headers?
Short instructions your server sends with every page, telling the browser how to protect your visitors: always use HTTPS, do not let other sites put your page in a frame, do not guess file types, and which scripts may run. Visitors never see them, but browsers follow them.
How is the grade worked out?
Strict-Transport-Security and Content-Security-Policy are worth 25 points each, clickjacking protection 20, X-Content-Type-Options 15, Referrer-Policy 10 and Permissions-Policy 5. Each header that announces your software version (such as X-Powered-By: PHP/7.4) costs 5. The Server header cannot be read from our checker, so check that one yourself. A is 90 or more, B 75, C 60, D 40, and F below that.
Will adding these headers break my website?
Most will not. Content-Security-Policy is the one to be careful with: a policy that leaves out a domain your site loads from (a font, a payment form, a chat widget) blocks it. Test it in Report-Only mode first.
Where do I add security headers?
Wherever your site is served from: your hosting's .htaccess or server settings, a WordPress security plugin, or Cloudflare's Transform Rules if your site runs through Cloudflare.
Do you keep my data?
We keep the address you checked and a summary of the result, so we can improve the tool. You do not need to give us your name or email. See our privacy policy.