Help Centre

Getting started

Headergrade is a one-shot diagnostics tool. You give it a URL, and it fetches that URL server-side, reads the HTTP response headers, and reports what it found — one header at a time, in plain language, with a copyable fix when something is wrong.

  1. Go to the Check a URL page.
  2. Enter the full URL (including https://) of the page you want to test — or just the domain name; Headergrade will prepend https:// automatically.
  3. Click Check. The tool fetches the URL, analyses six security headers, and displays the results within a few seconds.
  4. Expand any header card to see the raw value received, a plain-language explanation, and (if applicable) the one-line change to improve it.

Check your first URL now

Frequently asked questions

What headers does Headergrade check?
Six headers that matter for web security:
  • Content-Security-Policy — controls which resources (scripts, styles, images, fonts) the browser may load. A strong CSP stops XSS even if an attacker injects a script tag.
  • Strict-Transport-Security (HSTS) — forces HTTPS connections for a specified duration. Protects against protocol-downgrade attacks.
  • X-Content-Type-Options — prevents MIME-type sniffing. Reduces risk of drive-by downloads and script-injection attacks.
  • X-Frame-Options — controls whether your page may be displayed in a frame or iframe. Prevents clickjacking.
  • Referrer-Policy — controls how much referrer information is sent to other origins. Affects user privacy.
  • Permissions-Policy — controls which browser features (camera, microphone, location, sensors) the page and its embedded frames are allowed to use.
If a header is absent from the server's response, the tool says so — it never infers a value.
What do "good", "weak" and "missing" mean?
  • Good — the header is present with a value that provides meaningful protection for most sites. You can still improve it, but there is no urgent issue.
  • Weak — the header is present but has room for improvement. For example, HSTS with a short max-age is better than nothing but should be raised to a year. A too-permissive CSP (e.g. default-src 'self' https: without nonces) is flagged as weak.
  • Missing — the header was not sent at all. The tool provides a copyable snippet you can add to your server config.
These are practical judgments, not compliance certifications. We do not claim conformance with any regulation or standard.
Do you store the URLs I check?
No. Headergrade is stateless — it fetches the URL, analyses the response headers, and discards everything once the results are delivered to your browser. No logs with your URLs are kept, no accounts exist, and there is no database. The Terms of Service confirm this.
The check failed or returned an error. What happened?
Headergrade fetches the URL you supply from a server-side worker. Common reasons for failure:
  • The URL is unreachable — the server was down, refused the connection, or the DNS name does not resolve.
  • The server returned a non-200 status (e.g. 404, 500). The tool still reports headers from whatever response it received, but the analysis may be less useful.
  • The URL uses a private or local address — the tool will not connect to IP ranges reserved for private networks.
  • Rate limiting — if you send many requests in quick succession, the tool may temporarily pause additional checks. Wait a moment and try again.
If the problem persists, check that the URL is publicly accessible from a standard browser. If it is, and the tool still cannot reach it, something on our end may be the issue.
Why do you not check HTTPS configuration, SSL certificates, or other security aspects?
Headergrade is a header diagnostics tool, not a full security scanner. It focuses on the six response headers that are easy to misconfigure and invisible when you do. Checking TLS versions, certificate chains, cipher suites, cookie flags, or other aspects is outside scope — there are excellent dedicated tools for those (SSL Labs, securityheaders.com, etc.).
Will you notify me if my headers change or schedule recurring scans?
No. Headergrade answers when you ask it — it runs one check, once, on demand. There is no email sender, no notification system, no account system, and no way to schedule recurring scans. If you need ongoing monitoring, you would need to run checks yourself on a regular cadence. The Pro plan lists planned features (batch checks, API access) that may eventually help with this, but none are available yet.

Known limitations

Honest about what is and is not built

How to contact us

Headergrade does not have a dedicated support email address or a ticketing system. The best way to get help, report a bug, or suggest a feature is to open an issue at the project repository.

If you have found a security-relevant bug in the tool itself (rather than a header misconfiguration on your site), please follow responsible disclosure practices: describe the issue in a repository issue without including sensitive details, and we will follow up as quickly as possible.

For questions about these FAQs or the Terms of Service, the repository issue tracker is the right place as well. We aim to respond within a few business days.