zerobounce.ai
Websites

Security headers check

Grade a site’s HTTP security headers out of 100, see exactly where points went, and copy the headers that fix it.

By using these tools you accept the Terms and the Privacy page.

Any public page. Plain domains are checked over https://.

How the security headers check scores a site

The security headers check fetches a page and grades the protections its HTTP response headers ask browsers to apply. It is for developers and site owners who want an audit they can explain: every point is accounted for, and most gaps come with the header line to add.

How the page is fetched

The check follows up to six redirects and validates every hop before connecting to it, then grades the headers of the final page. It also asks the site’s root over plain http:// and stops at its first redirect to HTTPS; your path and query string, which can carry tokens, are never sent in clear text. The whole check stops after 20 seconds.

Requests made from Cloudflare’s network come back with Cloudflare’s own Server and cf-ray headers, even for sites that aren’t on Cloudflare. For those sites the check asks the server once more over a direct connection, so a version banner describes your server, not Cloudflare. If the address answers with an error page or a bot challenge, the result says so, because those headers may differ from your normal pages. Cloudflare’s own error pages (HTTP 520 to 530) aren’t graded.

Where the 100 points come from

Each check has a fixed maximum. The total sets the grade: A+ from 95 with no failed check, A from 85, B from 70, C from 55, D from 40, and F below that.

  • Content-Security-Policy: 25
  • HTTPS and the HTTP-to-HTTPS redirect: 15
  • Strict-Transport-Security: 15
  • Clickjacking protection: 10
  • Cookies: 10
  • X-Content-Type-Options, Referrer-Policy, Permissions-Policy, cross-origin policies and version disclosure: 5 each

Partial credit and common fixes

  • Content-Security-Policy: a policy rated strong earns all 25 points, a moderate one 17 and a weak one 8. A report-only policy on its own earns 3, because it blocks nothing. When a site sends several policies, browsers enforce all of them, so a weakness counts only if every policy has it.
  • HSTS: a max-age under six months earns 6 of 15 points, and one without includeSubDomains earns 11. A header browsers ignore, or max-age=0, earns none. Send max-age=31536000; includeSubDomains.
  • HTTPS redirect: if plain HTTP answers without redirecting, 5 of 15 points remain; if it doesn’t answer at all, 12. Redirect every http:// request to https:// with a 301.
  • Clickjacking: CSP frame-ancestors that doesn’t allow every site, or X-Frame-Options set to DENY or SAMEORIGIN, earns full points. Browsers ignore any other X-Frame-Options value, and ignore the header entirely once frame-ancestors is set.
  • Cookies: each problem costs 3 of the 10 points: a missing Secure, HttpOnly or SameSite attribute (an unknown SameSite value counts as missing), SameSite=None without Secure, or a __Host- or __Secure- name that breaks its prefix rules.
  • Referrer-Policy: browsers use the last value they recognise. None set earns 2 of 5, and unsafe-url or no-referrer-when-downgrade earns 1, because they send full URLs to other sites.
  • Permissions-Policy: restricting any feature earns 5; a header that allows every listed feature to all sites (*) earns 2, like the obsolete Feature-Policy.
  • Cross-origin policies: Cross-Origin-Opener-Policy is worth 3 points and Cross-Origin-Resource-Policy 2; the permissive unsafe-none and cross-origin values earn nothing.
  • Version banners: one banner, such as a Server header with a version number or X-Powered-By, leaves 2 of 5 points; two or more leave none.
  • Flagged without points: an X-XSS-Protection value other than 0, and CORS that allows any origin with credentials.

Using the fix kit and the evidence

The fix kit gathers every header the site is missing or should strengthen, one line per header, with CSP fixes merged directive by directive. Copy it as plain HTTP headers, as web server config lines (add_header, Header always set) or as a _headers file. Roll out a new policy as Content-Security-Policy-Report-Only first, because a strict policy can block scripts your pages rely on.

Below it, the result lists the CSP directives and each cookie’s flags when there are any, the redirect chain with the status and time of every hop, and all response headers. To check the connection itself, run the TLS checker.

Updated · Maintained by Liviu Tanase

Questions

What does the security headers check look at?

The HTTP response headers a site sends: HTTPS and the HTTP-to-HTTPS redirect, HSTS, Content-Security-Policy, clickjacking protection (frame-ancestors or X-Frame-Options), MIME sniffing, Referrer-Policy, Permissions-Policy, cookie flags, cross-origin policies and version banners.

How is the score worked out?

Each check is worth a fixed number of points, 100 in total, and the result lists the points for every line so the grade is never a mystery. CSP carries the most weight (25) because it is the one header that stops cross-site scripting. A+ needs 95 or more with no failed check.

My site sends a Content-Security-Policy but still lost points. Why?

A policy that allows 'unsafe-inline' scripts without nonces or hashes, any host (* or https:), or data: URLs barely limits an attacker, so it scores like a weak policy. Nonces or hashes with 'strict-dynamic', object-src 'none' and base-uri 'none' earn full marks.

Why does clickjacking protection fail when X-Frame-Options is set?

When a Content-Security-Policy has frame-ancestors, browsers ignore X-Frame-Options completely, so frame-ancestors * or https: lets any site frame the page even next to X-Frame-Options: DENY. Use frame-ancestors 'self' or 'none'. A repeated DENY, DENY header still counts; ALLOW-FROM is ignored by current browsers.

Why is my HSTS header ignored?

Browsers read only the first Strict-Transport-Security header, and drop it when max-age is missing, isn’t a plain number of seconds, or appears twice, as does a repeated includeSubDomains. Those, and max-age=0, which switches HSTS off, earn 0 of 15 points here. The preload list also needs a max-age of at least 31536000 with includeSubDomains and preload; the TLS checker covers the certificate side.

Does the check see a policy set in a meta tag?

No. It grades response headers and discards the page body, so a <meta http-equiv="Content-Security-Policy"> policy isn’t counted. Send the policy as a header: a meta policy can’t set frame-ancestors anyway. To see every hop of a redirect chain with its status, use the redirect trace.

Do security headers make my site secure?

They are hardening, not a substitute for secure code. Headers shut down whole classes of attack, such as cross-site scripting, clickjacking and protocol downgrades, but they can’t fix vulnerable application logic, weak authentication or leaked secrets.

Is the check visible to the site owner, and is anything stored?

The check makes ordinary requests from Cloudflare’s network: one to the address over HTTPS, following up to six redirects, and one to the site’s root over plain HTTP that stops at its first redirect to HTTPS, plus, for a site not on Cloudflare, one HEAD request to read its own server’s headers. Your path and query string are never sent over plain HTTP. It reads only the headers. The page body is discarded, the result is never cached, and cookie values are dropped once the headers are parsed; only names and flags are shown. Like every request to the site, the check appears in the request logs described on the privacy page.