What do your site's HTTP response headers actually say about it?

Security headers are easy to get wrong and invisible when you do. Headergrade fetches a URL and reports, header by header, what is set and what it means — in plain language, with copyable fixes.

Check a URL See plans

Not a score. An explanation.

01
Every header, present or not Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy — six headers that matter for security, each analysed individually.
02
Plain-language explanations For each header you see the raw value received, whether it is doing anything useful, and what it does in practice — not a compliance label or a threat score.
03
Copyable, concrete fixes When a header is missing or too permissive, the tool gives you the exact one-line change to improve it. Paste it into your server config and you are done.
04
No accounts, no alerts, no ads This tool checks one URL at a time, on demand, and stores nothing. Run it when you need an answer — no sign-up, no ongoing commitment.

Headers checked

Content-Security-Policy

Controls which resources the browser may load. A strong CSP stops XSS even if an attacker injects a script tag.

Strict-Transport-Security

Forces HTTPS connections for the specified duration. Protects against protocol-downgrade attacks.

X-Content-Type-Options

Prevents MIME-type sniffing. Reduces risk of drive-by download and script-injection attacks.

X-Frame-Options

Controls whether the page may be displayed in a frame. Prevents clickjacking attacks.

Referrer-Policy

Controls how much referrer information is sent to other origins. Affects user privacy.

Permissions-Policy

Controls which browser features (camera, mic, location) the page is allowed to use.

Who it is for

Developers and small-business owners who were told by a client, an auditor or a scanner that their headers are wrong, and want to know specifically what to change. No scare tactics, no upsells — just the plain-text readout of what your server actually sends.

Check your first URL