Security headers checker: is your site hardened?

Security headers are set at your web server or CDN, not in your page HTML. The exact syntax varies by platform, but the order of operations is the same everywhere:

1. Scan your current headers with the tool above to see what's present, missing, or weak.
2. Enforce HTTPS, then add HSTS. Once every page works over HTTPS, add Strict-Transport-Security: max-age=31536000; includeSubDomains.
3. Add a Content-Security-Policy in report-only mode. Watch the violation reports, fix anything legitimate it would block, then switch to enforcing.
4. Add the supporting headers: X-Frame-Options, X-Content-Type-Options: nosniff, Referrer-Policy, and a Permissions-Policy.
5. Re-scan to confirm the headers are live and your grade improved.

On Nginx use add_header, on Apache use Header set, and on Cloudflare, Netlify, or Vercel define them in a headers config file or transform rule. See the OWASP Secure Headers Project and MDN's HTTP headers reference for exact directives.

Most damaging website breaches don't involve sophisticated zero-days - they exploit basic misconfigurations. A missing Content-Security-Policy lets an injected script run and steal data. Cookies without protective flags get hijacked. A site that can be framed is vulnerable to clickjacking. Security headers shut down these entire attack classes for the cost of a few configuration lines, which is the best security return on investment most sites can make.

There's an SEO and trust dimension too. HTTPS is a confirmed Google ranking signal, and a site that gets hacked or blacklisted can be dropped from search results until it's cleaned up. Visitors increasingly notice browser security warnings, and a "Not Secure" label at the moment of decision quietly kills conversions. Hardening your headers protects rankings, reputation, and revenue at once.

90-100 (A): Strong posture. Keep an eye out for regressions after deployments.

80-89 (B): Good - usually a missing CSP or HSTS away from an A.

65-79 (C): Several headers missing; work the prioritized fixes in the report.

Below 65 (D/F): Under-hardened. Start with HTTPS, HSTS, and a Content-Security-Policy.

If you build or maintain sites for clients, this checker is a fast pre-launch and audit step - run it before every go-live and after infrastructure changes. It's free with no usage limits, so you can fold it into QA checklists and client reports. A clean header configuration is also an easy, demonstrable win to show clients early in an engagement. Need headers baked into your stack, a hardened CSP that doesn't break third-party scripts, or a full security and code-health review? Talk to our engineers.