Security Headers Checker
Analyze your site's HTTP security headers. Get a grade from A+ to F, see what's missing, and get exact config snippets for Nginx and Apache.
Why Security Headers Matter for Every Website
Security headers are the fastest, cheapest security improvement most websites can make. A single nginx.conf or .htaccess change can add six or more layers of browser-enforced security in minutes — no code deploys, no library updates, no security audits required.
The headers that have the biggest impact:
- Content-Security-Policy (25 pts): The most valuable header. A strict CSP eliminates entire classes of XSS attacks by whitelisting which scripts can run and where content can load from. Even a simple
default-src 'self'policy blocks the majority of XSS payloads. - Strict-Transport-Security (15 pts + 5 bonus): Permanently upgrades your site to HTTPS in the browser cache. The preload directive extends this to all browsers globally, eliminating the risk of the first-visit HTTP downgrade.
- X-Frame-Options + CSP frame-ancestors (10 pts): Prevents clickjacking by stopping other sites from embedding your page in an iframe and overlaying invisible UI elements to steal clicks.
- X-Content-Type-Options (10 pts): The easiest win — one line prevents browsers from second-guessing your declared content types, blocking a whole class of content-type confusion attacks.
- Referrer-Policy (10 pts): Prevents user session tokens, internal paths, and sensitive query parameters from leaking to third-party sites via the HTTP Referer header.
How to read your grade
The tool assigns a letter grade from A+ to F based on which headers are present and how strict each policy is. An A+ requires CSP, strict HSTS with preload, X-Content-Type-Options, frame ancestors, Referrer-Policy, and Permissions-Policy. A missing CSP alone can drop you to a C.
- A / A+: modern, defense-in-depth posture.
- B / C: essentials present but CSP or HSTS is weak.
- D / F: exposed to trivial clickjacking, MIME-sniffing, or mixed- content attacks.
Common issues and fixes
- CSP with
unsafe-inlineandunsafe-eval: defeats XSS protection — refactor to nonces or hashes. - HSTS without
preload: first-visit users are still vulnerable to downgrade; submit to the preload list after confirming HTTPS everywhere. - Both X-Frame-Options and frame-ancestors: modern browsers honor
frame-ancestorsand ignore X-Frame-Options — keep both for legacy coverage but make them consistent. - Missing Permissions-Policy: third-party iframes can access camera/geolocation by default; add an explicit deny list.
- Referrer-Policy
unsafe-urlor unset: leaks full URLs cross-origin — usestrict-origin-when-cross-origin.
What to do next
Roll out CSP in Content-Security-Policy-Report-Only mode first, collect violation reports for a week, then enforce. Audit every third-party script before whitelisting its origin.
For continuous monitoring, FlashMon.app tracks changes automatically and alerts you the moment something breaks.
Monitor security headers continuously
Get alerted the moment your security headers change — detect misconfigurations and configuration drift before they become vulnerabilities.
Frequently Asked Questions
HTTP security headers are directives sent by your web server in HTTP responses that instruct browsers on how to handle your site's content. Unlike application-level security measures (input validation, parameterized queries), security headers are enforced by the browser itself and require zero code changes to your application. Each header controls a specific browser behavior: Strict-Transport-Security forces HTTPS, Content-Security-Policy restricts where scripts can load from, X-Frame-Options prevents embedding, and so on. Together they form a second line of defense that reduces the impact of vulnerabilities that do make it into your application.
A Content Security Policy is the single most impactful security header. It defines a whitelist of allowed sources for every type of resource your page can load: scripts, styles, images, fonts, frames, and more. A properly configured CSP is the most effective mitigation against Cross-Site Scripting (XSS) attacks — even if an attacker manages to inject malicious JavaScript, the browser will refuse to execute it if it doesn't come from an approved source. The most common CSP mistakes are using 'unsafe-inline' (which defeats the main purpose), and using 'default-src *' (which allows loading from any origin). Start with a restrictive policy and relax it only as needed.
HSTS (HTTP Strict Transport Security) with preload submits your domain to a hardcoded list inside Chrome, Firefox, and Safari. Once preloaded, browsers will refuse to make any HTTP connection to your domain — even the very first visit — before they've received an HSTS header. Without preload, there's a window on a user's first visit (before they've ever connected to your site) where an attacker could intercept an HTTP request and downgrade it. Be cautious: preloading is hard to undo (it can take months to remove from the list), your entire domain and all subdomains must already be HTTPS-only before submitting, and you can't easily roll back if you need HTTP in the future.
Start with the headers that give you the most points for the least breakage risk. In order: (1) X-Content-Type-Options: nosniff — safe to add to any site, no configuration needed. (2) X-Frame-Options: DENY — safe unless you intentionally embed your site in iframes on other domains. (3) Referrer-Policy: strict-origin-when-cross-origin — safe for almost all sites. (4) Strict-Transport-Security — safe if your site is HTTPS-only; start with a short max-age and increase it over time. (5) Content-Security-Policy — this is the complex one; start in report-only mode with Content-Security-Policy-Report-Only to identify what would break before enforcing.
Both headers prevent your page from being embedded in iframes, protecting against clickjacking. X-Frame-Options is the older, simpler header with only two useful values: DENY (no framing allowed) and SAMEORIGIN (only same-origin framing). CSP's frame-ancestors directive is more powerful: it supports multiple sources, wildcards, and specific origin whitelists. Modern browsers support both, but when CSP frame-ancestors is present, it takes precedence over X-Frame-Options. Best practice is to include both for maximum compatibility: set X-Frame-Options: DENY as a fallback for older browsers, and add frame-ancestors 'none' to your CSP for everything else.
Most headers are safe to add immediately: X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and HSTS (with a short max-age first) carry virtually zero breakage risk. Content-Security-Policy is the exception — a strict CSP will block inline scripts, inline styles, and resources from unapproved origins, which can immediately break sites that rely on these. Use Content-Security-Policy-Report-Only first: it logs violations without enforcing them, letting you see what would break without affecting users. The Cross-Origin headers (COOP, CORP, COEP) can also break sites that embed third-party content — test carefully before enabling. FlashMon can monitor your site continuously to detect regressions after you deploy new headers.