Free tool
Security headers checker
Enter your site’s URL to grade its HTTP security headers. You’ll get a letter grade, a pass/fail on each header that matters, and a copy-ready value for every one you’re missing.
What the grade means
The two heaviest headers are HSTS (forces HTTPS) and a Content-Security-Policy (limits what can load and run, your main defense against cross-site scripting). For what each header does and where to set it, read the full security headers guide.
Frequently asked questions
What does this security headers checker test?
It fetches your URL and grades the security-relevant HTTP response headers: Strict-Transport-Security (HSTS), Content-Security-Policy, X-Content-Type-Options, clickjacking protection via X-Frame-Options or a frame-ancestors CSP directive, Referrer-Policy, and Permissions-Policy. Each header gets a pass, warning, or fail, and missing ones come with a copy-ready value to add.
What is a good security headers grade?
Aim for an A. The two that carry the most weight are HSTS, which forces HTTPS, and a Content-Security-Policy, which is the strongest defense against cross-site scripting. If you set those two plus X-Content-Type-Options and a clickjacking protection, you will land in the A range. A C or below usually means HSTS or CSP is missing.
Does a good grade mean my site is secure?
No. Security headers are one important layer, but they only harden the browser side. They do nothing about an exposed API key in your frontend, a database with Row Level Security turned off, or a JWT you decode without verifying. A strong headers grade is necessary but not sufficient, which is why a full scan checks the application itself, not just the headers.
Why does my Content-Security-Policy show a warning?
The checker flags a missing or empty CSP because it is the highest-impact header to add. If you have one and still see an issue, it is usually because the policy is not actually being sent on the response, or it is set only on some routes. Make sure the header is applied to every response your app serves, ideally in one place like middleware or your server config.
Headers are only the browser layer
A great headers grade won’t catch an exposed Supabase key, an open database, or a JWT you decode without verifying. Prbl scans the app itself for the mistakes AI coding tools ship most.
Run a free scan