Security headers checker

Why security headers matter

Each header closes a class of attack the browser would otherwise allow. A Content-Security-Policy contains cross-site scripting by controlling what can load and execute. Strict-Transport-Security stops protocol downgrade. Frame protection blocks clickjacking, X-Content-Type-Options stops MIME sniffing, Referrer-Policy keeps full URLs out of other people's logs, and Permissions-Policy switches off browser features like the camera or microphone that your pages never use.

They are also how outsiders judge you. Pentests flag missing headers on nearly every engagement, and rating platforms like SecurityScorecard, Bitsight and RiskRecon score them continuously, with results that reach your customers during vendor reviews. Our annual State of the Web report measures how few production sites send a complete set.

Below is a complete example of a secure configuration: a response carrying every header this checker looks for, at the values that score full marks. Copy it as a starting point. One header cannot be copied blindly, the Content-Security-Policy, because it has to name what your pages actually load; keep its structure and replace the sources, starting from your scan findings or from the CSP overview in our docs.

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Content-Type: text/html; charset=utf-8
Referrer-Policy: strict-origin-when-cross-origin
Cache-Control: no-store
Cross-Origin-Resource-Policy: same-origin
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp
Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=(), midi=(), serial=(), bluetooth=(), hid=(), display-capture=(), screen-wake-lock=(), idle-detection=(), window-management=(), local-fonts=()

Reporting-Endpoints: default="https://<Endpoint-ID>.report.centralcsp.com", csp="https://<Endpoint-ID>.report.centralcsp.com"
Report-To: {"group":"default","max_age":86400,"endpoints":[{"url":"https://<Endpoint-ID>.report.centralcsp.com"}]}
NEL: {"report_to":"default","max_age":86400,"failure_fraction":1.0}
Integrity-Policy: blocked-destinations=(script), endpoints=(default)
Document-Policy: document-write=?0; report-to=default
Connection-Allowlist: report-to=default

Content-Security-Policy: default-src 'none'; script-src 'nonce-{RANDOM_PER_RESPONSE}' 'strict-dynamic' 'report-sha256'; style-src 'self'; img-src 'self'; font-src 'self'; connect-src 'self'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'; object-src 'none'; worker-src 'self'; manifest-src 'self'; require-trusted-types-for 'script'; upgrade-insecure-requests; report-to csp

Set-Cookie: session=...; Path=/; Secure; HttpOnly; SameSite=Lax

Mandatory headers

Every page should send these. A missing one is a finding on its own, and together they carry most of the score.

Recommended headers

Defense in depth. Each one closes a narrower gap than the mandatory set, and a site sending all of them scores full marks.

Legacy headers

Superseded by something better. Sending them is not a mistake, but the modern replacement is what the score rewards.

Deprecated headers

Remove these. Every one is retired, and sending it adds bytes to every response without adding protection.

How to read your results

Every finding names the header, says what is wrong with it, and gives you the exact value to ship instead. A header missing? Flagged. A value that weakens the protection? Flagged too. And because headers live in your server, CDN or edge configuration, most fixes are one config line: deploy, hit rescan, watch the finding disappear.

What your score means

80 and above is a solid header set. 50 to 79 needs attention: the headers are mostly there but at least one value is doing less than it looks. Below 50 means critical gaps, usually a missing Content-Security-Policy or an HSTS header that expires too soon to matter.

The score is out of 100 and splits into two parts. The security score weighs how much real protection each value buys; the quality score weighs how cleanly the header set is written. That is also why this number can disagree with the A+ to F letter grade other scanners hand out: a letter grade largely rewards presence, so a site that sends every header can hold an A elsewhere and still score in the 60s here because two of those headers carry values that protect almost nothing.

How this compares to securityheaders.com and MDN HTTP Observatory

Both of those tools are free and both are a fine first look. The difference is what happens after the check. securityheaders.com and the MDN HTTP Observatory are largely presence checks that return a letter grade: they tell you a header is missing. This checker reads the value as well, so a header that is present but weak is a finding rather than a pass, and the result is a 0-100 score with each finding ranked by severity, an exploitation scenario, the exact value to ship instead, and CSV or PDF export.

That is also why the numbers disagree. A site sending every header with mediocre values scores well on a presence check and lands in the 60s here. Neither reading is wrong; they answer different questions.

Fixing a SecurityScorecard, Bitsight or RiskRecon finding

Two step-by-step walkthroughs cover the findings these platforms raise most often: fix SecurityScorecard CSP findings and fix BitSight CSP findings. For the July 2025 rating change specifically, see why BitSight now rates CSP.

If a vendor-risk review from SecurityScorecard, Bitsight or RiskRecon handed you a finding like "Content Security Policy (CSP) Missing", the fix is verifiable from where you sit. These platforms rate what your public HTTP responses show, with no agent and no login: correct the headers at your edge, and their next observation of your site sees the compliant response.

Scan the exact hostname named in the finding, with redirects followed: the apex, a www redirect and a subdomain can all answer with different headers, which explains most "but the homepage has a CSP" tickets. Apply the fixes, rescan to confirm, then use the platform's own resolve or rescan flow. One caveat we will not hide: scoring models are proprietary, so a fix closes the finding but no one can promise a specific score.

To keep the finding closed between reviews, CentralCSP monitors your policy from real browsers continuously.