Security Headers Checker

Analyze a public website's HTTP security headers and get an AppSec Santa heuristic grade from A+ to F.

Part of AppSec Santa's free website security scanners — five browser tools, no signup.

Instantly Score Your Security Headers

Enter a URL to get a current security headers report without setup or signup.

Instant A+ to F grade
Missing headers identified
Per-check score breakdown
Checks reachable public HTTP(S) sites

Security headers grade card showing score summary with A+ to F rating

11 Header and Response Checks

Each scan applies 11 checks using AppSec Santa's scoring model. The model borrows the HTTP Observatory's baseline, bonus gate, and grade bands, but its checks and score modifiers differ.

Content-Security-Policy (CSP) analysis
HSTS and HTTPS redirect checks
CORS misconfiguration detection
SRI and cookie security analysis

Scoring table showing 11 security test results with pass/fail indicators

Understand Every Security Header

Don't just see the results — understand what each header does and why it matters for your site's security.

Detailed explanation for every header
Score impact breakdown
Clear fix recommendations
CSP, HSTS, CORS, SRI and more

Methodology section showing detailed security header explanations in a card grid

Scan summary: —

Score: 0 / 100

Scan Time: —

Tests Passed: 0 / 0

Test	Score	Reason	Recommendation
* Bonus not applied — base score must be 90+ for extra credit.

What Are HTTP Security Headers?

HTTP response headers can constrain how browsers load, frame, and share a site's content. Correct settings can reduce risks such as cross-site scripting (XSS), clickjacking, protocol downgrade, and cross-origin data exposure, but headers are only one part of application security.

CSP

Content-Security-Policy

+10 to -25

CSP specifies which sources the browser may use for scripts, styles, images, and other resources. A policy tailored to the application can restrict inline script execution and untrusted resource loading, which helps mitigate some XSS paths.

HSTS

Strict-Transport-Security

+5 to -20

Forces browsers to use HTTPS for all future requests to a domain. Prevents SSL-stripping attacks where an attacker downgrades a connection from HTTPS to HTTP. The preload directive adds your domain to a browser-built-in HTTPS-only list.

XFO

X-Frame-Options

0 to -20

X-Frame-Options can deny framing or limit it to the same origin, helping mitigate clickjacking. CSP frame-ancestors offers more flexible framing control and earns a +5 bonus in this checker.

Referrer-Policy

+5 to 0

Controls how much referrer information is included with requests. Modern browsers use strict-origin-when-cross-origin as the default when no policy is specified, so this checker treats a missing header as neutral and awards a bonus for selected explicit policies.

Permissions-Policy

Informational

Controls which browser APIs and features, such as camera, microphone, geolocation, payment, and USB, may be used by the page and its iframes. Restricting unused features can reduce exposure. This checker reports the header but does not score it.

XCTO

X-Content-Type-Options

0 to -5

Setting this to nosniff tells browsers not to reinterpret a response away from its declared MIME type. This helps prevent certain script and style responses from being handled as an unintended content type.

CORS

Cross-Origin Resource Sharing

0 to -50

CORS controls which origins may read cross-origin responses in a browser. The checker sends a probe with a test Origin and flags a response that reflects that origin while allowing credentials; it also reports wildcard access separately.

RED

Redirection (HTTP → HTTPS)

0 to -20

Tests whether the site properly redirects HTTP requests to HTTPS. The checker follows the redirect chain from the HTTP version of your site and verifies it lands on a secure HTTPS URL. Sites that don't redirect or redirect to an insecure destination receive a penalty.

SRI

Subresource Integrity

+5 to -50

SRI lets a browser verify a fetched script or stylesheet against a declared cryptographic hash. This checker inspects external script tags in the retrieved HTML; it does not currently assess stylesheet integrity.

CORP

Cross-Origin-Resource-Policy

0 to -5

CORP tells browsers whether a resource may be loaded with cross-origin no-cors requests. same-origin and same-site restrict that loading boundary; cross-origin permits it.

info

Cross-Origin Isolation (COOP & COEP)

Informational

COOP (Cross-Origin-Opener-Policy) isolates your window from cross-origin popups. COEP (Cross-Origin-Embedder-Policy) ensures all embedded resources are explicitly shared. Together they enable cross-origin isolation for advanced APIs like SharedArrayBuffer. These are analyzed for visibility but not included in the score.

Scoring Methodology

This is an AppSec Santa heuristic, not an MDN HTTP Observatory result or a security certification. It starts at 100, applies penalties from 11 checks, and adds bonuses only when the score after penalties is at least 90. The two-round structure and grade bands are adapted from the HTTP Observatory methodology; the checks and modifiers are not identical.

Score	Grade	Interpretation
100+	A+	Highest band in this model
90–99	A	A band in this model
85–89	A-	A-minus band
80–84	B+	B-plus band
70–79	B	B band
65–69	B-	B-minus band
60–64	C+	C-plus band
50–59	C	C band
45–49	C-	C-minus band
40–44	D+	D-plus band
30–39	D	D band
25–29	D-	D-minus band
0–24	F	Lowest band in this model

Need a Full DAST Scanner?

Security headers are just one piece of the puzzle. Dynamic Application Security Testing (DAST) tools crawl and attack your web app to find vulnerabilities like SQL injection, XSS, and authentication flaws.

Compare DAST Tools