SEO Tool

Security Headers Grader

Grade any URL's HTTP security headers A+ to F — HSTS, CSP, X-Frame-Options, Referrer-Policy and more. Get copy-paste fix snippets for Nginx, Apache, Vercel and Cloudflare.

✅ Free Forever 🔒 No Signup ⚡ Instant Results 🌐 Browser Based

Quick Answer

The Security Headers Grader fetches any URL and checks the 8 most important HTTP security response headers — HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP and COEP — then awards a single letter grade (A+ to F) with copy-paste fix snippets for Nginx, Apache, Vercel and Cloudflare Workers.

Quick Facts

Tool Name: Security Headers Grader
Category: SEO Tool
Price: ✓ Free
Platform: Browser Based
Login Required: ✓ No
Last updated: 2026-05-20

How to Use Security Headers Grader

Enter Your Input
Paste your text or fill in the required fields in the tool above.
Click Generate
Hit the generate or analyze button to start processing.
Get Instant Results
The tool processes your input instantly in your browser.
Copy or Export
Copy your results to clipboard or download the output.

Frequently Asked Questions

Everything you need to know about Security Headers Grader

Which security headers does the grader check?

Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy. We weight HSTS and CSP highest because they prevent the most common attacks (HTTP downgrade and XSS).

Why did my A grade drop to a B after I added CSP?

A CSP that includes 'unsafe-inline' or 'unsafe-eval' is downgraded to a 'weak' pass — these directives let attackers inject scripts that bypass CSP entirely. Move inline scripts/styles to external files or use nonces (CSP nonce-RANDOM) to get the full score.

Should I use CSP frame-ancestors instead of X-Frame-Options?

Yes, for new sites. CSP frame-ancestors is the modern equivalent, more expressive (supports per-origin allow-listing) and is honored by all current browsers. Keep X-Frame-Options too for legacy browser compatibility — it doesn't hurt.

Why is my Permissions-Policy showing as a warning?

If the header is absent, your site can be embedded in a third-party iframe with camera, microphone, geolocation, USB and payment APIs enabled by default. Adding even a minimal Permissions-Policy that disables what you don't use is a quick win.

Is the audited site notified or rate-limited?

No notification — we make a single GET request with our User-Agent and read only headers. We follow up to 5 redirects, with SSRF protection (private IPs and metadata endpoints are blocked). No rate-limiting other than your own browser.

Need more than free tools?

Get Custom AI Solutions from AI2Flows