Free tool
Security headers
A few lines your server sends with every page protect your visitors against clickjacking, content injection and insecure connections. We read them and give you a grade.
How the grade works
Each header is worth points: HSTS and CSP 25 each, X-Frame-Options and X-Content-Type-Options 15, Referrer-Policy and Permissions-Policy 10. Showing software versions costs 5 points; a site without HTTPS cannot score above 30.
Where to add them
Apache / .htaccess
Header set
Header always set X-Content-Type-Options "nosniff"
Needs mod_headers, which almost every host enables.
nginx
add_header
add_header X-Content-Type-Options "nosniff" always;
In the server block, or in Plesk under “Additional nginx directives”.
WordPress
Host first
A plugin can add them, but the server does it faster and for every file.
Many hosts have a “security headers” setting.
Frequently asked questions
Does my site have the right security headers?
Enter the site address: the tool reads the headers the server sends (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) and gives a grade based on which ones are present.
How is the grade calculated?
Each header is worth points: HSTS and CSP 25 each, X-Frame-Options and X-Content-Type-Options 15, Referrer-Policy and Permissions-Policy 10. Showing software versions costs 5 points, and a site without HTTPS cannot score above 30.
Where do I add the missing headers?
On Apache, in the .htaccess file with Header set (mod_headers). On nginx, with add_header in the server block. With WordPress, start at the host level: the server does it faster than a plugin.
