Security Headers Checker

About the Security Headers Checker

Enter a website address, or paste response headers, and get an A+ to F grade for the headers that tell browsers how to protect your visitors: Content-Security-Policy, Strict-Transport-Security (HSTS, with preload eligibility), X-Frame-Options / frame-ancestors, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy and the Secure, HttpOnly and SameSite flags on cookies. Each problem is explained — what the header does, what is wrong and how to fix it — with a link to the standard where one applies.

Each header is parsed the way browsers parse it — CSP Level 3’s rules for duplicate directives, fallbacks and 'strict-dynamic', RFC 6797 for HSTS, the HTML Standard’s X-Frame-Options algorithm, RFC 8941 structured fields for Permissions-Policy — so a typo that makes a browser silently ignore your header is caught, not just a missing header. Suggested headers then turns the results into configuration for Nginx, Apache, Caddy, IIS, Cloudflare Pages or Netlify _headers, Vercel or Express.

Common uses

• Checking a new site or a server migration before launch — and again after every CDN, proxy or framework change, which often drops headers.
• Writing a first Content-Security-Policy: start with the suggested Report-Only policy, then tighten it.
• Answering a penetration-test or security-questionnaire item about missing security headers, with a report to attach.
• Confirming that session cookies are Secure, HttpOnly and SameSite after a login change.
• Seeing whether a domain is ready for the HSTS preload list — and what you would be committing to.

What each header does — and a safe value to start with

• Content-Security-Policy — which scripts, styles, frames and other resources a page may load. The strongest form is a strict, nonce-based policy: script-src 'nonce-{random}' 'strict-dynamic'; object-src 'none'; base-uri 'none', with a fresh random nonce of at least 128 bits in every response (CSP Level 2 §4.2). Roll it out as Content-Security-Policy-Report-Only first.
• Strict-Transport-Security — max-age=31536000; includeSubDomains: browsers then use only HTTPS for your host for a year (RFC 6797). Add includeSubDomains only once every subdomain works over HTTPS.
• Clickjacking protection — Content-Security-Policy: frame-ancestors 'self' (or 'none'), plus X-Frame-Options: SAMEORIGIN for very old browsers. ALLOW-FROM is ignored by current browsers.
• X-Content-Type-Options — nosniff, the only valid value.
• Referrer-Policy — strict-origin-when-cross-origin (also the browser default) or no-referrer.
• Permissions-Policy — switch off what you do not use: camera=(), microphone=(), geolocation=(). Origins go in double quotes: geolocation=(self "https://maps.example.com").
• Cross-Origin-Opener-Policy — same-origin, or same-origin-allow-popups if you rely on OAuth or payment pop-ups.
• Cookies — session cookies need Secure; HttpOnly; SameSite=Lax (or Strict); the __Host- prefix also locks a cookie to your host. SameSite=None without Secure makes browsers reject the cookie (RFC 6265bis).

How the grade is calculated

Each check has a share of 100 points: Content-Security-Policy 30, HSTS 20, clickjacking protection 15, X-Content-Type-Options 10, Referrer-Policy 10, Permissions-Policy 5, Cross-Origin-Opener-Policy 5 and cookies 5.

• CSP: nonce- or hash-based (strict) 30; a host allowlist 22; 'unsafe-inline', *, https: or data: for scripts 8; set but not restricting scripts 5; Report-Only only 3. Strict and allowlist policies lose 2 without an object-src restriction and 2–3 without base-uri; 'unsafe-eval' costs 4.
• HSTS: one year or more with includeSubDomains 20 (18 without); 180 days to a year 14; shorter 8; missing, invalid or max-age=0 0.
• Clickjacking: frame-ancestors with 'none', 'self' or listed sites, or X-Frame-Options DENY or SAMEORIGIN 15; conflicting values 11; frame-ancestors * 3.
• Referrer-Policy: no-referrer, same-origin, strict-origin or strict-origin-when-cross-origin 10; not set (browser default) 7; origin or origin-when-cross-origin 7; no-referrer-when-downgrade 4; unsafe-url 0.
• Permissions-Policy 5 (3 when a powerful feature such as the camera is allowed for every site, 2 when no listed feature is recognised, 0 when missing or invalid); COOP same-origin or noopener-allow-popups 5, same-origin-allow-popups 4, otherwise 0; cookies 5 (also when none are set), minus 2 per cookie without Secure or rejected by browsers, 1 per session cookie readable by JavaScript and 1 per invalid SameSite value or session cookie without one; a Set-Cookie that deletes a cookie (Max-Age=0 or a past Expires) does not count.

Grades: A+ from 95, A from 85, B from 70, C from 55, D from 40, F below. A page that is not served over HTTPS gets at most a D. Without any CSP the best possible grade is a B. The weighting is MySmartCoPilot’s own reading of the standards listed below — guidance, not a security audit.

HSTS preload: eligible is not the same as advisable

The HSTS preload list is built into browsers, so they use HTTPS for a domain even on the first visit. Its submission requirements: a valid certificate; a redirect from HTTP to HTTPS on the same host if you listen on port 80; HTTPS on every subdomain — including www if it has a DNS record, and internal subdomains; and on the base domain an HSTS header with max-age of at least 31536000, includeSubDomains and preload, also on an HTTPS redirect.

The checker shows which of these it could verify, using hstspreload.org’s stricter reading of the header (for example, it does not accept a quoted max-age). hstspreload.org itself says: “While HSTS is recommended, HSTS preloading is not recommended.” It also warns that inclusion cannot easily be undone and that a removal takes months to reach users. Add preload only if you are sure.

What a URL check sends

Only the address goes to MySmartCoPilot’s server (Cloudflare). It requests the page with GET as MySmartCoPilotBot, without cookies, follows at most 5 redirects and discards the body unread; it also requests the http:// version once without following its redirect. Before each new host is contacted its DNS records are looked up over HTTPS and every address must be public: private, loopback, link-local, carrier-grade NAT and cloud-metadata addresses and internal names are refused, and every redirect target is checked again. Results are cached on the server for up to 10 minutes, so repeated checks of the same address usually do not reach the site again (Check again can refresh a result after a minute), and each visitor has a limited number of checks per hour.

Sources

• OWASP Secure Headers Project — recommended values and the list of headers to remove (headers_add.json and headers_remove.json)
• W3C Content Security Policy Level 3 (Working Draft) and CSP Level 2 §4.2 for nonce length
• web.dev, Mitigate cross-site scripting (XSS) with a strict Content Security Policy
• RFC 6797 (HSTS) and hstspreload.org
• HTML Standard (X-Frame-Options, COOP, COEP) and Fetch Standard (nosniff, CORP)
• W3C Referrer Policy (Editor’s Draft), W3C Permissions Policy (Editor’s Draft) and its policy-controlled feature list, and RFC 8941 structured fields
• draft-ietf-httpbis-rfc6265bis-22 (cookies; in the RFC Editor queue)

Limitations

• One URL’s response headers are checked. Other pages, API endpoints and files can send different headers — check the pages that matter most (login, account, checkout).
• A Content-Security-Policy set in a <meta> tag is not seen by a URL check, because the page body is not read. (A meta policy cannot set frame-ancestors, report-uri or sandbox anyway.)
• Cookies set by JavaScript, or only after you log in, are not visible to a URL check. Paste the headers of a logged-in response to check those.
• Firewalls and bot protection may answer MySmartCoPilot’s server with an error or a challenge page. The checker warns when the final status is 403, 429 or 503 — paste the headers from your browser instead.
• The grade measures headers, not your application: it cannot find cross-site scripting or other bugs, and a good grade is not a security audit.
• HSTS preload eligibility is only partly checked: the certificate and every subdomain are tested by hstspreload.org when you submit. The SSL Certificate Checker shows a site’s certificate and its official preload status.
• Very long header values are analysed up to 16 KB each (64 KB per response).

Privacy

Pasted headers are analysed in your browser and never uploaded. For a URL check only the address is sent to MySmartCoPilot’s server, which fetches the page’s headers from the website and returns them. The server keeps the result in memory for up to 10 minutes and does not save it anywhere else; its log records only the host name, status code and time of each request — never the full URL or your IP address. Cookie values are left out of the downloadable report.