Security Headers Analyzer
Scan your website's HTTP response headers to identify missing security policies and misconfigurations.
Security Grade
Why HTTP Security Headers Matter
When your web browser requests a page from a web server, the server responds with the content along with HTTP Response Headers. These headers configure security defenses natively inside the user's browser. Adding the right security headers is one of the easiest and most effective ways to protect your website and users from malicious attacks like Cross-Site Scripting (XSS), Code Injection, and Clickjacking.
Content-Security-Policy (CSP)
CSP is the strongest defense against XSS attacks. It allows site administrators to declare approved sources of content that the browser may load (e.g., restricting JavaScript execution only from your own domain and preventing inline malicious scripts).
Strict-Transport-Security (HSTS)
HSTS forces the browser to only load your website over a secure HTTPS connection, even if the user types `http://`. This protects against protocol downgrade attacks and cookie hijacking on public Wi-Fi networks.