Does the backend follow redirects?

No. A single GET is performed against the exact URL you submit, matching the backend security model.

How is this different from pasting headers manually?

This tool fetches live response headers server-side and grades them automatically. The HTTP Security Header Checker tool still supports pasted header blocks client-side.

Security Headers Checker

Grade HTTP security headers with a live server-side GET request

Target URL

Public https URL only — private hosts are blocked.

Try an example:

Examples

Default site with no security headers

Input

https://example.com

Output

Grade F · missing HSTS, CSP, frame protection

Many default sites score poorly until headers are configured at the CDN or web server.

About this tool

Security Headers Checker performs one server-side GET against the URL you submit and grades HSTS, CSP, clickjacking protections, MIME sniffing controls, referrer policy, and related headers.

Each finding includes what the header does and how to fix a missing or weak value. Redirects are not followed — grade the exact URL you enter (often the apex or www canonical URL).

How to use

Enter a public HTTPS URL
Use the exact page to test, e.g. https://www.example.com/
Review findings
Expand each item for meaning, recommended fix, and MDN documentation links.
Fix critical headers first
Prioritize HSTS and CSP, then framing and nosniff.

Use cases

Pre-release audit

Verify staging matches production header policy before go-live.

CDN migration check

Confirm Cloudflare or Vercel response headers after changing SSL/HSTS settings.

Common mistakes

Mistake:Testing http:// when the site redirects to https.

Fix:Enter the final HTTPS URL you want graded — redirects are not followed.

Mistake:Expecting headers on API JSON routes only.

Fix:Security headers matter most on HTML document responses; API routes may differ.

Frequently asked questions