EA Digital Solutions
SEOSchemaMeta TagsBriefGEOOG PreviewImageColorsBGUTMRedirectsPHPE-mailSpeedHeadersAI crawlersMockup

HSTS · CSP · TLS

Security header check: does your website send the protective headers?

With a few HTTP headers a website tells the browser to load it only encrypted, block injected scripts and refuse embedding by other sites. This free check shows which of them your start page sends, checks the certificate and grades the result from A+ to F.

The check only loads the start page, once over https:// and once over http://, and reads the certificate. No other pages are requested and no attacks are attempted.

Knowledge

Security headers: which ones a website should send

Every website should redirect http to https and send at least Strict-Transport-Security, a Content-Security-Policy, X-Content-Type-Options: nosniff, protection against embedding (frame-ancestors or X-Frame-Options) and a Referrer-Policy. OWASP and MDN recommend these headers; they are set in the server configuration and add practically no load time.

How we score

CheckPoints
http:// redirects straight to https://15
Strict-Transport-Security with max-age ≥ 6 months and includeSubDomains20
Content-Security-Policy that does not allow inline scripts wholesale20
X-Content-Type-Options: nosniff10
Clickjacking protection (X-Frame-Options or frame-ancestors)10
Referrer-Policy set10
Permissions-Policy set5
No software versions in Server, X-Powered-By, X-AspNet-Version10

Grades: A+ from 95, A from 85, B from 70, C from 55, D from 40, below that F. Partial points: HSTS shorter than six months 8, without includeSubDomains 15; CSP with effective 'unsafe-inline' 10, without script rules 8, report-only 5; indirect https redirect 10; weak Referrer-Policy 3; minus 5 per version leak. Without working HTTPS or with an invalid certificate: F.

A solid starting point

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src 'self'; frame-ancestors 'self'
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()

Adapt the Content-Security-Policy to your site before enforcing it: every external service (fonts, maps, videos, analytics) has to be allowed explicitly. Set includeSubDomains only if every subdomain works over HTTPS.

Rather have it done? Book a free call →

Security header check: frequently asked questions

What are security headers?

HTTP response headers with which a website tells the browser how to protect visitors: load the site only over HTTPS (HSTS), only run scripts from allowed sources (Content-Security-Policy), do not let other sites embed it (X-Frame-Options or frame-ancestors), and similar rules. They add practically no load time and are set in the server or hosting configuration.

How is the grade calculated?

Each header earns points according to the table on this page, 100 in total. A+ from 95 points, A from 85, B from 70, C from 55, D from 40, below that F. Without working HTTPS or with an expired, untrusted or wrong certificate the grade is F regardless of points.

Does a good grade mean my website is secure?

No. The check looks at the headers of the start page and at the certificate. Outdated plugins, weak passwords or a vulnerable server are not visible from the outside this way. The headers are one layer among several.

Can a Content-Security-Policy break my website?

Yes, if it is too strict: maps, videos, tracking or chat tools may stop loading. Start with Content-Security-Policy-Report-Only, read the reported violations and only then enforce the policy.

What does the check request?

The start page once over https:// and once over http://, following redirects, plus one TLS handshake on port 443 to read the certificate. No other pages are requested and no attacks are attempted. We store the checked address and the result in our tool log, never your IP address.

Sources