Security Headers Check

Grade any site's HTTP security headers — HSTS, CSP, clickjacking, cookies and more. Same A+–F style as the TLS checker.

What gets checked

HSTS — is HTTPS enforced, and for long enough?
Content-Security-Policy — is there one, and does it actually restrict scripts?
Clickjacking — X-Frame-Options or CSP frame-ancestors
Cookies — Secure, HttpOnly and SameSite flags
Hygiene — MIME sniffing, referrer leaks, version banners, HTTP→HTTPS redirect

Only response headers are fetched — page bodies are discarded. Nothing is stored.