Security Headers Checker — Grade and Fix HTTP Response Headers

The Security Headers Checker performs one server-side GET and grades:

• HSTS — force HTTPS on repeat visits
• CSP — XSS defense in depth
• Frame protection — clickjacking (X-Frame-Options or CSP frame-ancestors)
• nosniff, Referrer-Policy, Permissions-Policy, COOP/COEP

Each finding expands with what it means, how to fix, and an MDN link.

Usage tips

• Enter the exact HTTPS URL to grade — redirects are not followed
• Fix critical headers (HSTS, CSP) before informational ones
• Compare CDN vs origin by testing both URLs

For pasted header blocks without a live fetch, use the client-side HTTP Security Header Checker.

See also OWASP Secure Headers.