How this check works
The check makes an HTTPS request to the URL from our server, follows up to five redirects (HTTPS only), and reads the response headers of the final page. It checks nine headers that instruct browsers to apply protections, scores them and grades the result. Plain HTTP is upgraded to HTTPS and never fetched.
The headers
| Header | What it does |
|---|---|
| Strict-Transport-Security (HSTS) | Tells browsers to use HTTPS only for this site, for max-age seconds |
| Content-Security-Policy | Limits where scripts, styles and other resources may load from; the strongest defence against cross-site scripting |
| X-Frame-Options | Stops other sites framing yours (clickjacking). CSP's frame-ancestors is the modern equivalent |
| X-Content-Type-Options | nosniff stops browsers guessing content types |
| Referrer-Policy | Controls how much of the URL is sent to other sites in the Referer header |
| Permissions-Policy | Turns off browser features such as camera, microphone and geolocation for the page |
| Cross-Origin-Opener-Policy | Isolates your window from pages it opens, or that open it |
| Cross-Origin-Embedder-Policy | Requires embedded resources to opt in to being loaded |
| Cross-Origin-Resource-Policy | Stops other sites embedding your resources |
How to read the results
The grade is a quick summary, not an audit. A missing header matters more on a site with sign-in, forms or user content than on a static brochure site. Start with HSTS and nosniff, which rarely break anything. Add a CSP in report-only mode first (Content-Security-Policy-Report-Only), fix what it reports, then enforce it. X-XSS-Protection isn't checked: browsers have removed the feature it controlled.
Updated 26 October 2026