Security Headers Checker
Check which security headers a page sends, get a grade, and copy the Nginx or Apache lines to add the missing ones.
The headers we check
| Header | Helps protect against | Points |
|---|---|---|
Strict-Transport-Security | Requests being downgraded to plain HTTP and intercepted. | 25 |
Content-Security-Policy | Injected scripts running on your pages (cross-site scripting). | 25 |
X-Frame-Options or frame-ancestors | Other sites framing your pages to trick visitors into clicking (clickjacking). | 15 |
X-Content-Type-Options | Browsers running a file as a different type than intended. | 10 |
Referrer-Policy | Full URLs, including private query strings, leaking to other sites. | 10 |
Permissions-Policy | Scripts and frames asking for the camera, microphone or location. | 10 |
| No version leaks | Server and framework versions shown in Server or X-Powered-By. | 5 |
This is the NosHost header checklist score: A+ from 95, A from 85, B from 70, C from 50, D from 30, F below that. Partly correct headers earn some points. It describes the inspected response and does not establish the site's overall security.
Adding headers without breaking your site
- Back up the affected configuration and test each header in a preview first.
X-Frame-Optionscan prevent intended embedding, whilePermissions-Policycan disable needed browser features. Choose values that fit your application. - Add HSTS with a short
max-agesuch as 300 seconds. Once everything works, raise it to a year. - Roll out a Content-Security-Policy in report-only mode, check the browser console and reports for blocked items, adjust, then enforce it.
Limitations
- We check one page. Other pages, especially ones served by a different app or a CDN rule, may send different headers.
- Headers set with a
<meta http-equiv>tag in the HTML are not read. Only real HTTP headers count for most of these, and HSTS only works as a header. - We check that a CSP exists and avoids the riskiest settings. We do not test whether it fits your site.
Questions
Do I still need X-XSS-Protection?
No. Browsers removed the filter it controlled. A Content-Security-Policy is the modern replacement. If you still send it, set it to 0 or remove it.
Should I submit my site to the HSTS preload list?
Only when you are sure every subdomain, now and in future, will use HTTPS. Preloading is built into browsers and takes months to undo. It needs max-age of at least one year, includeSubDomains and preload.
My host does not let me edit the server config. What can I do?
On Apache hosting, the lines can usually go in .htaccess. If your site is behind Cloudflare, Transform Rules can add headers on the free plan. Many CMS security plugins can add them too.