Security headers inspector

HTTP response headers are a quiet but powerful layer of web security. Directives like Strict-Transport-Security, Content-Security-Policy, X-Frame-Options and Referrer-Policy tell the browser how to protect your visitors — forcing HTTPS, restricting where scripts can load from, preventing your site from being framed for clickjacking, and controlling what referrer data leaks to other sites. This inspector fetches a site’s response headers, evaluates which protections are present and how well they are configured, and summarises the result as a grade from A+ to F.

The grade is a quick way to see where you stand, but the detail is where the value is: it shows which headers are missing or weak and why each matters, so you can prioritise. A strong Content-Security-Policy, for instance, is one of the most effective defences against cross-site scripting, while HSTS ensures browsers never fall back to insecure HTTP after the first visit.

Use it to audit your own site before and after hardening changes, and to understand the trade-offs — an overly strict policy can break legitimate functionality, so the goal is meaningful protection that still lets your site work. Re-run after each change to confirm the headers take effect as intended.