Your HTTP response headers: HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, and grades what is present, weak or missing.
Free · no account
Security headers check
Paste an address and we grade the HTTP security headers a browser receives – HSTS, CSP, X-Frame-Options and more.
We only read the public response headers. Nothing is stored, no account required.
What the check shows
We read the response headers and grade the key security headers.
Six key headers
HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
A grade
An overall grade (A–F) and score, so you see where you stand at a glance.
What is missing
Exactly which headers are present, missing or too weak.
More free tools
Test more on your site
Standalone, free tools — no account needed.
Website test
Full outside-in scan: platform, hosting, SSL, domain and tags at once.
SSL & certificate check
Issuer, expiry and days left for any site's certificate.
WordPress check
Version, theme and common exposures — seen from the outside.
Tracking tag check
Which analytics and ad tags are installed, with their IDs.
Security headers — questions
They close common attack vectors (clickjacking, MIME sniffing, downgrade) at the edge, cost nothing and do not change how the site looks. Most sites ship with almost none.
Start with HSTS, X-Frame-Options, X-Content-Type-Options and Referrer-Policy, safe on almost any site. Add Permissions-Policy, then CSP last (test carefully).
Yes – security headers are a one-off grade, so make it part of your deploy routine: a server or config change can silently drop a header. For continuous monitoring, Ravnsight watches the uptime, SSL and domain that such changes can break, and alerts you from a second country when something actually goes down.
Keep an eye on more than headers
Ravnsight watches uptime, certificates, performance and more – and tells you when something breaks.