HTTP Security Headers Grader
Fetch a Uniform Resource Locator (URL) and grade its HyperText Transfer Protocol (HTTP) security headers — Content Security Policy (CSP), HTTP Strict Transport Security (HSTS), X-Frame-Options, Referrer-Policy, Permissions-Policy, and more.
Monitor this automatically
NetTests can run this check on a schedule, preserve historical results, compare changes over time, and alert you the moment something breaks.
Start monitoring free → See all monitoring productsFrequently Asked Questions
Which security headers does this tool grade?
The key headers checked: Content-Security-Policy (Cross-Site Scripting (XSS) mitigation), Strict-Transport-Security (HyperText Transfer Protocol Secure (HTTPS) enforcement), X-Frame-Options (clickjacking prevention), X-Content-Type-Options: nosniff (Multipurpose Internet Mail Extensions (MIME) sniffing), Referrer-Policy (controls Referer header leakage), and Permissions-Policy (restricts browser features like camera/microphone).
What is the most impactful header to add?
Content-Security-Policy is the most powerful but complex — it restricts which scripts, styles, and resources browsers can load, significantly reducing Cross-Site Scripting (XSS) impact. Start with Strict-Transport-Security (max-age=31536000; includeSubDomains) as it's easy to add and prevents protocol downgrade attacks.
What score would a typical site get?
Most sites score D or F on automated header graders — missing Content Security Policy (CSP) and Permissions-Policy is very common. An A grade requires all major headers including a non-trivial CSP. Even a B (HTTP Strict Transport Security (HSTS) + X-Frame-Options + nosniff + Referrer-Policy without CSP) significantly improves baseline security posture.