PerfoMetrix

All tools · Security

Security Headers Checker

Test HSTS, Content-Security-Policy, clickjacking protection and other HTTP security headers, and get an A+ to F grade with exact fixes.

This is one of our 170+ checks.

Run the full audit: performance, security, SEO and AI readiness in one report, free and without sign-up.

Run the full audit →

What the Security Headers Checker checks

HTTP security headers are instructions your server sends with every response. They tell the browser how to behave on your page: only connect over HTTPS, which scripts may run, whether other sites may frame the page, and how much of the URL to share when a visitor follows a link.

This checker requests the page you enter and reads the response headers exactly as a browser receives them. It looks at Strict-Transport-Security (HSTS), Content-Security-Policy (presence, unsafe-inline, unsafe-eval, wildcard sources, and missing object-src or base-uri), clickjacking protection through X-Frame-Options or the CSP frame-ancestors directive, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and Cross-Origin-Opener-Policy. The result is a grade from A+ to F. An A+ requires a strict CSP and HSTS with the preload flag.

Why it matters

Headers do not fix bugs in your code, but they limit the damage when one slips through. A good Content-Security-Policy turns many cross-site scripting flaws into blocked requests. HSTS stops a visitor on hostile Wi-Fi from being downgraded to plain HTTP. Framing protection prevents clickjacking, where your page is loaded invisibly under a fake button.

They are also cheap: most are a single line in your web server, CDN or framework config, and security questionnaires from customers and partners regularly ask about them.

How to fix common problems

Start with the low-risk headers that rarely break anything: X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, Permissions-Policy: camera=(), microphone=(), geolocation=() and Cross-Origin-Opener-Policy: same-origin (use same-origin-allow-popups if you rely on OAuth or payment pop-ups).

Add HSTS once every page and subdomain works over HTTPS: Strict-Transport-Security: max-age=63072000; includeSubDomains; preload. The preload list requires a max-age of at least 31536000 seconds plus includeSubDomains and preload; submit the domain at hstspreload.org only when you are sure, because removal is slow.

Roll out CSP in Content-Security-Policy-Report-Only mode first, watch the reports, then enforce. Prefer nonces or hashes over unsafe-inline, and always set object-src 'none'; base-uri 'self'; frame-ancestors 'self'. The X-XSS-Protection header is obsolete and can be left out. To see these headers next to TLS, cookies, DNS and 170+ other checks, run the full PerfoMetrix audit.

Questions

Why do I get an A and not an A+?

An A+ needs both a strict Content-Security-Policy (no unsafe-inline, unsafe-eval or wildcard script sources) and HSTS with the preload flag. Everything else can be perfect and the grade still stops at A.

Should I use X-Frame-Options or frame-ancestors?

frame-ancestors in your CSP is the modern option and takes precedence in current browsers. Sending X-Frame-Options: SAMEORIGIN as well does no harm and covers older clients. A frame-ancestors directive inside a meta tag is ignored, so it must be a response header.

Will a Content-Security-Policy break my site?

It can, which is why you should start in Report-Only mode. The browser then logs what the policy would block without blocking it, so you can adjust the policy before enforcing it.

Does this tool check every page of my site?

No. It checks the response of the URL you enter. Headers often differ between pages, apps and subdomains, so test the important entry points separately.