Security headers checker
Grade the HTTP security headers of any page from A+ to F. We fetch the URL once and the score comes back. The rules are printed below, so you can check our maths.
This check runs in Supercheck.
The free checker isn't available on this site. The method below shows what it looks at.
Try it in SupercheckHow we check
- Scoring follows Mozilla HTTP Observatory, limited to what one response can show. We start at 100.
- Bonuses count only when the score is already 90 or more. A missing header lowers the score; it never fails you on its own.
- We never keep Set-Cookie values, so cookies are not graded.
What this check can't tell you
- Headers only. A good grade means the browser gets the right instructions, not that the app has no bugs.
- One check from one Cloudflare data center, usually the one nearest you. It can't tell you whether the site is down for everyone.
Scoring rules
We start at 100 and apply each rule. Bonuses count only when the score is already 90 or more. The score never goes below 0.
| Header | Condition | Score |
|---|---|---|
| Content-Security-Policy | Missing (report-only counts as missing) | −25 |
| script-src (or script-src-elem / script-src-attr) allows 'unsafe-inline' without a nonce or hash, data:, * or http: | −20 | |
| script-src allows 'unsafe-eval' | −10 | |
| No unsafe sources and object-src 'none' | +5 | |
| Strict-Transport-Security | Missing, invalid, or the final URL is http | −20 |
| max-age under six months | −10 | |
| max-age of a year or more, includeSubDomains and preload | +5 | |
| X-Content-Type-Options | Not nosniff | −5 |
| Framing | No X-Frame-Options (DENY or SAMEORIGIN) and no CSP frame-ancestors | −20 |
| CSP frame-ancestors set | +5 | |
| Referrer-Policy | no-referrer, same-origin, strict-origin or strict-origin-when-cross-origin | +5 |
| unsafe-url, origin, origin-when-cross-origin, or invalid | −5 | |
| Permissions-Policy, COOP | Shown, not scored | 0 |
Grades: A+ 100+ · A 90–99 · A− 85–89 · B+ 80–84 · B 70–79 · B− 65–69 · C+ 60–64 · C 50–59 · C− 45–49 · D+ 40–44 · D 30–39 · D− 25–29 · F 0–24.
Questions
- Why don't you score cookies?
- We don't keep Set-Cookie values from your site, so we can't grade them honestly.
- Is this a security audit?
- No. It covers headers only.
- Do you store the URL I check?
- Results sit in a 10-minute cache. Logs keep the host and the first path segment, never the full URL or query string, and never your IP address.
- Can I stop my site from being checked?
- Yes. The SupercheckBot page explains how to ask for an opt-out; we add your domain to a block list.