--- title: "Free HTTP security headers checker & fixes" description: "Scan any URL's HTTP security headers free: CSP, HSTS, X-Frame-Options, Permissions-Policy, cookies. Get a score out of 100 and a fix per finding. No signup." url: "https://centralcsp.com/en/tools/security-headers/" lang: "en" --- Tools # Security headers checker Enter a URL and get every HTTP security header your site sends, scored out of 100 with a severity-ranked fix list. ### Scan a URL Audit a site's HTTP security headers and cookies, with a hardening score and prioritized fixes. Follow redirects Scan security headers Only need the Content-Security-Policy analyzed in depth? [Use the CSP scanner](https://centralcsp.com/en/tools/csp-scanner/) Sample result ## What a header scan gives you A score out of 100, the exact headers the server sent, and a fix attached to every flagged value. Run the scanner above to see your own. 65 / 100 Security headers need attention Overall security score ### Next actions Replace 'unsafe-inline' in script-src with nonces or hashes Raise the HSTS max-age to at least one year Add a Permissions-Policy disabling unused browser features Add Secure, HttpOnly and SameSite to the session cookie Security How well the site resists client-side attacks. 58 /100 The configuration has security gaps to address. Quality Hygiene only: typos, duplicates, dated values. 84 /100 Cleanly written overall, with a little left to tidy: a dated value, a redundant directive. None of it changes how protected the site is. * * * Flagged values are tinted by severity. Select one to see what is wrong, the impact, and the fix to apply. content-security-policy[](https://centralcsp.com/en/docs/web-security/policies/content-security-policy) default-src 'self' script-src 'self' 'unsafe-inline' https://js.example-cdn.com frame-ancestors 'none' strict-transport-security max-age=2592000 x-frame-options SAMEORIGIN x-content-type-options nosniff referrer-policy strict-origin-when-cross-origin x-xss-protection 1; mode=block * * * ### Findings & recommendations Issues and quality recommendations for these security headers. ### script-src allows 'unsafe-inline' The Content-Security-Policy permits inline scripts, so any markup injection becomes script execution. This single keyword removes most of the XSS protection a CSP exists to provide. High Security High Security Recommendation Move inline scripts behind per-request nonces or hashes, then list only the script origins your pages actually load. Impact An attacker who can inject HTML anywhere on the page, a comment field, a search echo, a broken template, can run arbitrary JavaScript in your visitors' browsers and read anything on the page, including payment forms. ### Strict-Transport-Security max-age is too short The HSTS lifetime is 2592000 seconds, thirty days. Browsers forget the HTTPS pin quickly, and the site does not qualify for preload. Medium Security Medium Security Recommendation Raise max-age to at least 31536000 (one year) and add includeSubDomains once every subdomain serves HTTPS. Impact A visitor who has not opened the site within thirty days can be downgraded to plain HTTP by an on-path attacker on their next first request. ### No Permissions-Policy header The response sends no Permissions-Policy, so the page and every iframe in it keep default access to powerful browser features like the camera, microphone and geolocation. Medium Security Medium Security Recommendation Send a Permissions-Policy that disables the features your pages never use, for example camera=(), microphone=(), geolocation=(). Impact A compromised third-party script or an embedded frame can request device features under your origin's name. ### Session cookie is missing Secure, HttpOnly and SameSite The session cookie sets only Path. Without Secure it can travel over plain HTTP, without HttpOnly any script on the page can read it, and without SameSite it is attached to cross-site requests. Medium Security Medium Security Recommendation Send Set-Cookie: session=...; Path=/; Secure; HttpOnly; SameSite=Lax, and consider the \_\_Host- prefix once the cookie is host-scoped. Impact An XSS on any page of the origin can read the session cookie and replay it, and a cross-site request can carry it without the user acting. ### X-XSS-Protection is deprecated Every current browser has removed the XSS auditor this header controlled. The value 1; mode=block does nothing in modern browsers and enabled information leaks in older ones. Low Quality Low Quality Recommendation Remove the header or send X-XSS-Protection: 0, and rely on the Content-Security-Policy instead. Guide ## Understanding HTTP security headers HTTP security headers are response headers a server sends so the browser enforces protections on the page, set in server, CDN or edge configuration rather than in application code. They cost nothing to send, and they are the first thing a pentest, a security-rating platform or an attacker checks. ### Why security headers matter Each header closes a class of attack the browser would otherwise allow. A Content-Security-Policy contains cross-site scripting by controlling what can load and execute. Strict-Transport-Security stops protocol downgrade. Frame protection blocks clickjacking, X-Content-Type-Options stops MIME sniffing, Referrer-Policy keeps full URLs out of other people's logs, and Permissions-Policy switches off browser features like the camera or microphone that your pages never use. They are also how outsiders judge you. Pentests flag missing headers on nearly every engagement, and rating platforms like [SecurityScorecard](https://securityscorecard.com), [Bitsight](https://www.bitsight.com) and [RiskRecon](https://www.riskrecon.com) score them continuously, with results that reach your customers during vendor reviews. Our annual [State of the Web report](https://centralcsp.com/en/state-of-the-web/) measures how few production sites send a complete set. Below is a complete example of a secure configuration: a response carrying every header this checker looks for, at the values that score full marks. Copy it as a starting point. One header cannot be copied blindly, the Content-Security-Policy, because it has to name what your pages actually load; keep its structure and replace the sources, starting from your scan findings or from the [CSP overview in our docs](https://centralcsp.com/en/docs/web-security/policies/content-security-policy). Transport, content and framing The baseline set. HTTPS is pinned, sniffing is off, referrers are trimmed, and every browser feature your pages never use is switched off. ``` Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff Content-Type: text/html; charset=utf-8 Referrer-Policy: strict-origin-when-cross-origin Cache-Control: no-store Cross-Origin-Resource-Policy: same-origin Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), midi=(), serial=(), bluetooth=(), hid=(), display-capture=(), screen-wake-lock=(), idle-detection=(), window-management=(), local-fonts=() ``` Reporting and enforcement Where the browser sends what it observes, so a blocked script or a failed request reaches you instead of dying in someone else's console. ``` Reporting-Endpoints: default="https://.report.centralcsp.com", csp="https://.report.centralcsp.com" Report-To: {"group":"default","max_age":86400,"endpoints":[{"url":"https://.report.centralcsp.com"}]} NEL: {"report_to":"default","max_age":86400,"failure_fraction":1.0} Integrity-Policy: blocked-destinations=(script), endpoints=(default) Document-Policy: document-write=?0; report-to=default Connection-Allowlist: report-to=default ``` The Content Security Policy Keep the structure and swap the sources for what your pages actually load. The nonce is regenerated on every response. ``` Content-Security-Policy: default-src 'none'; script-src 'nonce-{RANDOM_PER_RESPONSE}' 'strict-dynamic' 'report-sha256'; style-src 'self'; img-src 'self'; font-src 'self'; connect-src 'self'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'; object-src 'none'; worker-src 'self'; manifest-src 'self'; require-trusted-types-for 'script'; upgrade-insecure-requests; report-to csp ``` Cookies Only on the responses that set one. The checker reads these three attributes on every Set-Cookie your site sends. ``` Set-Cookie: session=...; Path=/; Secure; HttpOnly; SameSite=Lax ``` ### Mandatory headers Every page should send these. A missing one is a finding on its own, and together they carry most of the score. Mandatory security headers and what each protects against | Header | What it protects against | | --- | --- | | [Content-Security-Policy](https://centralcsp.com/en/docs/web-security/policies/content-security-policy) | Cross-site scripting, injected scripts, and clickjacking through frame-ancestors | | [Strict-Transport-Security](https://centralcsp.com/en/docs/web-security/security-headers/strict-transport-security) | Protocol downgrade and cookie theft on the wire | | [X-Content-Type-Options](https://centralcsp.com/en/docs/web-security/security-headers/x-content-type-options) | MIME sniffing turning an uploaded file into a script | | [Content-Type](https://centralcsp.com/en/docs/web-security/security-headers) | Ambiguous responses, when the charset is missing or the type does not match the body | | [Set-Cookie attributes](https://centralcsp.com/en/docs/web-security/security-headers/cookie-security) | Session cookies without Secure, HttpOnly or SameSite | ### Recommended headers Defense in depth. Each one closes a narrower gap than the mandatory set, and a site sending all of them scores full marks. Recommended security headers and what each protects against | Header | What it protects against | | --- | --- | | [Referrer-Policy](https://centralcsp.com/en/docs/web-security/security-headers/referrer-policy) | Leaking full URLs and their parameters to third parties | | [Permissions-Policy](https://centralcsp.com/en/docs/web-security/policies/permissions-policy) | Camera, microphone, geolocation and payment access your pages never use | | [Cross-Origin-Resource-Policy](https://centralcsp.com/en/docs/web-security/security-headers/cross-origin-resource-policy) | Your resources being embedded by other sites | | [Cross-Origin-Opener-Policy](https://centralcsp.com/en/docs/web-security/policies/cross-origin-opener-policy) | Cross-window attacks, and the prerequisite for cross-origin isolation | | [Cross-Origin-Embedder-Policy](https://centralcsp.com/en/docs/web-security/policies/cross-origin-embedder-policy) | Embedding resources that never opted in | | [Cache-Control](https://centralcsp.com/en/docs/web-security/security-headers/cache-control) | Sensitive or authenticated responses cached where they should not be | | [Reporting-Endpoints](https://centralcsp.com/en/docs/web-security/reporting-api/headers/reporting-endpoints) | Violations the browser generates and silently drops, with nowhere to send them | | [NEL](https://centralcsp.com/en/docs/web-security/policies/network-error-logging) | DNS, TLS and connection failures your server never sees | | [Integrity-Policy](https://centralcsp.com/en/docs/web-security/policies/integrity-policy) | Scripts loading without Subresource Integrity anywhere on the site | | [Document-Policy](https://centralcsp.com/en/docs/web-security/policies/document-policy) | Document behaviours you want switched off, such as document.write | | [Connection-Allowlist](https://centralcsp.com/en/docs/web-security/policies/connection-allowlist) | Network egress to origins you never approved | ### Legacy headers Superseded by something better. Sending them is not a mistake, but the modern replacement is what the score rewards. Legacy security headers and what replaced them | Header | Why it is legacy | | --- | --- | | [X-Frame-Options](https://centralcsp.com/en/docs/web-security/security-headers/x-frame-options) | Clickjacking, superseded by CSP frame-ancestors. Keep it only for very old browsers | | [Report-To](https://centralcsp.com/en/docs/web-security/reporting-api/headers/report-to) | Superseded by Reporting-Endpoints, but still required to deliver NEL reports | ### Deprecated headers Remove these. Every one is retired, and sending it adds bytes to every response without adding protection. Deprecated security headers to remove | Header | What it protects against today | | --- | --- | | [X-XSS-Protection](https://centralcsp.com/en/docs/web-security/security-headers/deprecated-headers) | Nothing. The browser XSS auditor it drove was removed, and enabling it caused leaks | | [Expect-CT](https://centralcsp.com/en/docs/web-security/security-headers/deprecated-headers) | Nothing. Certificate Transparency is enforced by browsers by default | | [Public-Key-Pins](https://centralcsp.com/en/docs/web-security/security-headers/deprecated-headers) | Nothing. Pinning is removed from browsers and could lock you out of your own site | | [Feature-Policy](https://centralcsp.com/en/docs/web-security/security-headers/deprecated-headers) | Nothing. Renamed to Permissions-Policy | ### How to read your results Every finding names the header, says what is wrong with it, and gives you the exact value to ship instead. A header missing? Flagged. A value that weakens the protection? Flagged too. And because headers live in your server, CDN or edge configuration, most fixes are one config line: deploy, hit rescan, watch the finding disappear. ### What your score means 80 and above is a solid header set. 50 to 79 needs attention: the headers are mostly there but at least one value is doing less than it looks. Below 50 means critical gaps, usually a missing Content-Security-Policy or an HSTS header that expires too soon to matter. The score is out of 100 and splits into two parts. The security score weighs how much real protection each value buys; the quality score weighs how cleanly the header set is written. That is also why this number can disagree with the A+ to F letter grade other scanners hand out: a letter grade largely rewards presence, so a site that sends every header can hold an A elsewhere and still score in the 60s here because two of those headers carry values that protect almost nothing. ### How this compares to securityheaders.com and MDN HTTP Observatory Both of those tools are free and both are a fine first look. The difference is what happens after the check. securityheaders.com and the MDN HTTP Observatory are largely presence checks that return a letter grade: they tell you a header is missing. This checker reads the value as well, so a header that is present but weak is a finding rather than a pass, and the result is a 0-100 score with each finding ranked by severity, an exploitation scenario, the exact value to ship instead, and CSV or PDF export. That is also why the numbers disagree. A site sending every header with mediocre values scores well on a presence check and lands in the 60s here. Neither reading is wrong; they answer different questions. ### Fixing a SecurityScorecard, Bitsight or RiskRecon finding Two step-by-step walkthroughs cover the findings these platforms raise most often: [fix SecurityScorecard CSP findings](https://centralcsp.com/en/blog/fix-securityscorecard-csp-findings) and [fix BitSight CSP findings](https://centralcsp.com/en/blog/fix-bitsight-csp-findings). For the July 2025 rating change specifically, see [why BitSight now rates CSP](https://centralcsp.com/en/blog/bitsight-rau25-was-csp). If a vendor-risk review from [SecurityScorecard](https://securityscorecard.com), [Bitsight](https://www.bitsight.com) or [RiskRecon](https://www.riskrecon.com) handed you a finding like "Content Security Policy (CSP) Missing", the fix is verifiable from where you sit. These platforms rate what your public HTTP responses show, with no agent and no login: correct the headers at your edge, and their next observation of your site sees the compliant response. Scan the exact hostname named in the finding, with redirects followed: the apex, a www redirect and a subdomain can all answer with different headers, which explains most "but the homepage has a CSP" tickets. Apply the fixes, rescan to confirm, then use the platform's own resolve or rescan flow. One caveat we will not hide: scoring models are proprietary, so a fix closes the finding but no one can promise a specific score. To keep the finding closed between reviews, [CentralCSP monitors your policy](https://centralcsp.com/en/platform/monitoring/) from real browsers continuously. Keep reading - [Web security fundamentals](https://centralcsp.com/en/docs/web-security) - [Content-Security-Policy overview](https://centralcsp.com/en/docs/web-security/policies/content-security-policy) - [Security headers reference](https://centralcsp.com/en/docs/web-security/security-headers) - [The Strict-Transport-Security header](https://centralcsp.com/en/docs/web-security/security-headers/strict-transport-security) - [How to improve your security headers grade](https://centralcsp.com/en/blog/improve-security-headers-grade) - [Legacy security headers you can retire](https://centralcsp.com/en/blog/legacy-security-headers-to-retire) More free tools ## Keep auditing with the other free tools Every tool is free, runs without an account, and scores with the same severity scale. ### CSP scanner Fetch a URL's live Content-Security-Policy and score it against known bypasses, wildcard sources and missing directives. - Directive-level findings - Shareable results link [Run the CSP scanner](https://centralcsp.com/en/tools/csp-scanner/) ### CSP evaluator Paste a policy that is not deployed yet and get the same scoring and findings as a live scan, no URL required. - Audit before you ship - Same scoring engine [Evaluate a policy in the CSP evaluator](https://centralcsp.com/en/tools/csp-evaluator/) ### Reporting API checker Check that violation reporting actually works: endpoints, Reporting-Endpoints and Report-To, and which security features really report. - Endpoint and feature mapping - Silent drops flagged [Check your Reporting API setup](https://centralcsp.com/en/tools/reporting-api/) ### SRI hash generator Turn a CDN script or stylesheet URL into its Subresource Integrity hash, with a ready-to-paste tag and a CORS check. - SHA-256, 384 and 512 - CORS verified for you [Generate an SRI hash](https://centralcsp.com/en/tools/sri-hash/) ### CSP hash generator Turn an inline script or style into the hash that lets it run under a strict policy, right in your browser. - Runs entirely client-side - SHA-256, 384 and 512 [Generate a CSP hash](https://centralcsp.com/en/tools/csp-hash/) ### Website compare See where your score stands: your site beside the dataset average and the year's best-configured sites, control by control. - Published, auditable references - Radar view per category [Compare your site to the best](https://centralcsp.com/en/tools/compare/) FAQ ## Frequently asked questions Headers, scores, scanners and ratings, answered. ### What are HTTP security headers? HTTP security headers are response headers a server sends so the browser enforces protections on the page: Content-Security-Policy restricts what can load and execute, Strict-Transport-Security forces HTTPS, X-Frame-Options and frame-ancestors stop clickjacking, X-Content-Type-Options stops MIME sniffing, Referrer-Policy limits what URLs leak to other sites, and Permissions-Policy disables browser features a page does not need. They are set in the server, CDN or edge configuration, not in application code. ### Which security headers should a website send in 2026? Five are mandatory: a Content-Security-Policy, Strict-Transport-Security with a max-age of at least 31536000 plus includeSubDomains, X-Content-Type-Options: nosniff, a Content-Type carrying a charset, and Secure, HttpOnly and SameSite on every cookie. Clickjacking is covered by the policy's frame-ancestors directive, not by X-Frame-Options, which is now legacy. Recommended on top: Referrer-Policy, Permissions-Policy, Cross-Origin-Resource-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy, Cache-Control, and the reporting set (Reporting-Endpoints, NEL, Integrity-Policy, Document-Policy). X-XSS-Protection, Expect-CT, Public-Key-Pins and Feature-Policy are deprecated: remove them. ### What is a good security headers score? 80 out of 100 and above is a solid header set, 50 to 79 needs attention, and below 50 means critical gaps. The score covers both security findings, how much protection each value actually buys, and quality findings, how cleanly the set is written. The heaviest weights sit on the Content-Security-Policy and on Strict-Transport-Security, so the three moves that shift the number most are: ship a policy without 'unsafe-inline', set HSTS to max-age=31536000 with includeSubDomains, and add X-Content-Type-Options: nosniff. ### Is this security headers checker free? Yes. There is no account, no email gate and no limit on reading your results: they live at a shareable URL and export to CSV or PDF. The scan runs from our servers against the URL you enter, so it refuses private and internal addresses, and you can rescan any time after deploying a fix. ### How is this different from securityheaders.com? securityheaders.com checks whether a short list of response headers is present and assigns a letter grade; it is a fine first look. This checker parses the values: the Content-Security-Policy directive by directive, cookie flags, deprecated and conflicting settings. Each finding gets a severity and a concrete fix, security findings include an exploitation scenario, and results export to CSV and PDF for a ticket or an audit trail. Both tools are free. ### Why does SecurityScorecard or Bitsight flag my site when another checker passes it? Because they judge value quality and your whole footprint, not one page's header presence. SecurityScorecard evaluates the final URL of the redirect chain and scans every subdomain in your digital footprint. Since July 2025 Bitsight's Web Application Security risk vector loads pages in a real browser, so a present but permissive Content-Security-Policy fails even though a presence check passes. Scan the exact hostname named in the finding, with redirects followed, to see what their scanner saw. ### Are missing security headers actually a vulnerability? On their own they are usually a low-severity pentest finding: defense in depth rather than a direct exploit. They cost you in three ways. An XSS or clickjacking flaw that a policy would have contained becomes fully exploitable. Vendor-risk platforms and questionnaires flag them to your customers. And for payment pages, PCI DSS v4 requires monitoring security headers as received by the consumer browser (requirement 11.6.1), so absent headers become a compliance gap, not just a hardening one. ### Do security headers affect SEO? Not directly: no security header is a ranking factor, and adding one will not move a position on its own. Two indirect effects are real, though. Strict-Transport-Security supports HTTPS, which Google does use as a lightweight signal. And a Content-Security-Policy that is too strict can block your own scripts, styles or fonts, which breaks rendering and shows up in Core Web Vitals, so a policy shipped without a report-only run can cost you where the headers themselves never would. ## A scan shows today. Monitoring shows every day after. CentralCSP collects Content-Security-Policy reports from your real visitors' browsers and alerts you when a policy breaks or an unknown script appears, so the headers you just fixed stay fixed. Add one header, no code changes. [Start with CentralCSP](https://app.centralcsp.com) [See continuous header monitoring](https://centralcsp.com/en/platform/monitoring/) --- Available in: [en](https://centralcsp.com/en/tools/security-headers/), [fr](https://centralcsp.com/fr/tools/security-headers/)