SEO Tool

Security Headers Grader

Grade any URL's HTTP security headers A+ to F — HSTS, CSP, X-Frame-Options, Referrer-Policy and more. Get copy-paste fix snippets for Nginx, Apache, Vercel and Cloudflare.

✅ Free access 🔒 No Signup ⚡ Online checks 🌐 Browser Based

Quick Answer

The Security Headers Grader fetches any URL and checks the 8 most important HTTP security response headers — HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP and COEP — then awards a single letter grade (A+ to F) with copy-paste fix snippets for Nginx, Apache, Vercel and Cloudflare Workers.

Quick Facts

Tool Name: Security Headers Grader
Category: SEO Tool
Price: Free access; request and input limits may apply.
Platform: Browser Based
Login Required: ✓ No
Processing & privacy: Online checks send submitted URLs or inputs to our server or the services described in the tool. No paid AI features are enabled.
Scope: Results describe the submitted input and supported checks. They do not guarantee accuracy, search rankings, indexing or AI citations. Read our testing and scoring methodology.

How to Use Security Headers Grader

Enter Your Input
Paste your text or fill in the required fields in the tool above.
Run the Tool
Use the controls above; some browser tools update as you type.
Review the Results
Review the output and any warnings. Hosted checks need an internet connection.
Copy or Export
Use the available copy or download controls, and review suggestions before publishing.

Frequently Asked Questions

Everything you need to know about Security Headers Grader

Which security headers does the grader check?

Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy. We weight HSTS and CSP highest because they prevent the most common attacks (HTTP downgrade and XSS).

Why did my A grade drop to a B after I added CSP?

A CSP that includes 'unsafe-inline' or 'unsafe-eval' is downgraded to a 'weak' pass — these directives let attackers inject scripts that bypass CSP entirely. Move inline scripts/styles to external files or use nonces (CSP nonce-RANDOM) to get the full score.

Should I use CSP frame-ancestors instead of X-Frame-Options?

Yes, for new sites. CSP frame-ancestors is the modern equivalent, more expressive (supports per-origin allow-listing) and is honored by all current browsers. Keep X-Frame-Options too for legacy browser compatibility — it doesn't hurt.

Why is my Permissions-Policy showing as a warning?

If the header is absent, your site can be embedded in a third-party iframe with camera, microphone, geolocation, USB and payment APIs enabled by default. Adding even a minimal Permissions-Policy that disables what you don't use is a quick win.

Is the audited site notified or rate-limited?

No notification — we make a single GET request with our User-Agent and read only headers. We follow up to 5 redirects, with SSRF protection (private IPs and metadata endpoints are blocked). No rate-limiting other than your own browser.

Need more than free tools?

Get Custom AI Solutions from AI2Flows