Paste a URL. We follow its redirects, list every response header the final page sends, grade the six security headers (HSTS, Content-Security-Policy, X-Content-Type-Options, clickjacking protection, Referrer-Policy, Permissions-Policy) from A+ to F, and flag missing compression, caching, a stray noindex and software versions you're giving away. Free, no signup.
30 free checks a day. We fetch the page the way a crawler does (no JavaScript, no cookies).
We ran this checker on 18 home pages on 25 October 2026. Only 2 send all six security headers. Content-Security-Policy is the most often missing (8 of the 15 graded sites lack it), and two still tell everyone their server version.
| Site | Grade and what's missing |
|---|---|
| bbc.co.uk | A+ 6/6 |
| cloudflare.com | A+ 6/6 |
| github.com | A 5/6: no Permissions-Policy |
| theguardian.com | A 5/6: no Referrer-Policy |
| mozilla.org | A 5/6: no Permissions-Policy |
| apple.com | B 4/6: no Referrer-Policy, Permissions-Policy |
| stripe.com | B 4/6: no Referrer-Policy, Permissions-Policy; no Cache-Control |
| php.net | C 3/6: no CSP, nosniff, Referrer-Policy |
| python.org | D 2/6: no CSP, nosniff, Referrer-Policy, Permissions-Policy |
| shopify.com | D 2/6: no CSP, clickjacking protection, Referrer-Policy, Permissions-Policy |
| microsoft.com | F 1/6: only HSTS |
| wikipedia.org | F 1/6: only HSTS; Server: ATS/9.2.15 |
| wordpress.org | F 1/6: only X-Frame-Options; HSTS max-age is 1 hour |
| nginx.org | F 1/6: only HSTS; Server: nginx/1.31.3 |
| example.com | F 0/6 |
| nytimes.com | no grade HTTP 403 bot wall |
| amazon.com | no grade HTTP 202 bot wall |
| google.com | no grade HTTP 429 to our server |
A grade only covers headers; it says nothing about the site's code. Bot walls (403, 202, 429) answer unknown fetchers with a different response than browsers get, so we show their headers without a grade.
| Strict-Transport-Security | Tells browsers to use HTTPS only for this domain, so nobody on the network can downgrade a visit to plain HTTP. max-age=31536000; includeSubDomains. We count it as passing from 180 days. |
| Content-Security-Policy | Lists where scripts, styles and frames may load from; an injected <script> from elsewhere won't run. Start with default-src 'self' and add your CDNs, or use nonces. Try it first as Content-Security-Policy-Report-Only. |
| X-Content-Type-Options | nosniff: browsers trust your Content-Type instead of guessing, so an uploaded text file can't run as a script. |
| X-Frame-Options / frame-ancestors | Stops other sites from loading yours in a hidden iframe to trick clicks. X-Frame-Options: SAMEORIGIN, or CSP frame-ancestors 'self' (the modern form, which also allows a list of sites). |
| Referrer-Policy | How much of your URL other sites see when someone follows a link. strict-origin-when-cross-origin sends only the domain cross-site. |
| Permissions-Policy | Switches off browser features the page doesn't use, for the page and any embedded iframes: camera=(), microphone=(), geolocation=(). |
# nginx (inside server { }; "always" also adds them to error pages)
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
server_tokens off;On Apache, the same lines go in as Header always set Name "value" (needs mod_headers). On Express, helmet() sets most of them and app.disable('x-powered-by') hides the framework. On Netlify or Cloudflare Pages, a _headers file does it. Add CSP last, in report-only mode first: a strict policy that blocks your own analytics or fonts breaks the page silently.
This check also runs over the Shotmint API, free with any key (500 checks a day, 0 credits), so a CI step can fail a deploy that drops a security header:
curl -s "https://shotmint.creasework.com/v1/check?type=headers&url=https://example.com" \
-H "X-API-Key: YOUR_KEY"
# {"type":"headers", "credits_used":0, "status":200, "grade":"F", "security_passed":0,
# "security_total":6, "checks":[...], "headers":[...], ...}This checker reads HTTP responses without running JavaScript. To see what a page looks like after its scripts run, the Shotmint API renders it in Chromium and reports the final page's status in an X-Page-Status header on every screenshot and PDF:
curl -sD - -o page.png "https://shotmint.creasework.com/v1/screenshot?url=https://example.com" \
-H "X-API-Key: YOUR_KEY" | grep -i x-page-status
# x-page-status: 200More free checks for the same page: redirect checker, robots.txt checker, structured data checker, Open Graph checker.
SSL checker · SPF checker · Broken link checker · DMARC checker · Redirect checker · Website technology checker · llms.txt checker · Structured data checker · robots.txt checker · Favicon checker · Open Graph checker · Diff checker · all free tools