Security Headers
Grade a site on HSTS, CSP, X-Frame-Options and other security headers.
Frequently asked questions
Which security headers are checked?
Strict-Transport-Security (HSTS), Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy — the headers that most affect a site's security posture.
What do the A to F grades mean?
The grade is a weighted score of which recommended security headers are present. A means nearly all are set correctly; F means most are missing.
Why do security headers matter?
They defend against clickjacking, MIME-sniffing, protocol downgrade and cross-site scripting. Adding them is one of the cheapest ways to harden a website.
What does the Content-Security-Policy header do?
A Content-Security-Policy restricts which sources of scripts, styles, images and other resources a page may load, which is one of the strongest defenses against cross-site scripting and injection attacks.
What is HSTS and why should I enable it?
HTTP Strict-Transport-Security tells browsers to always use HTTPS for your site for a set period, preventing protocol-downgrade and cookie-hijacking attacks. Adding your domain to the preload list strengthens it further.
What is the difference between X-Frame-Options and frame-ancestors?
Both control whether your site can be embedded in a frame to prevent clickjacking. X-Frame-Options is the older header, while the frame-ancestors directive in Content-Security-Policy is the modern, more flexible replacement.
Does adding security headers slow down my site?
No. Security headers are tiny pieces of metadata sent with the response and have no measurable performance cost, so there is no speed reason to leave them off.