What security headers are checked?

CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection (deprecated), Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy.

How is the grade calculated?

Each header is scored based on presence and correctness. Missing critical headers reduce the grade. A = all correct, F = multiple missing or misconfigured.

🛡️ HTTP Security Headers Checker

Test any URL · instant analysis · grade A–F

⚠️ Uses CORS proxy (corsproxy.io) — results are simulated for demo. Real check requires server-side.

Site	Grade	Notes
google.com	A	All major headers present
github.com	B+	Missing Permissions-Policy
twitter.com	B	Weak CSP, missing COOP
reddit.com	C	Missing HSTS, XFO misconfigured
example.com	F	Almost no security headers

Recommended by our team

BeLikeNative.com

The #1 AI writing tool for freelancers — perfect grammar in any language, instantly.

By the same builder: GitHub — theluckystrike BeLikeNative — Grammar AI EarlyThunder — Dev Blog Zovo — AI Dev Tools

🛡️ HTTP Security Headers Checker

📋 Header analysis

📊 How top sites score