Check security headers
How well does a website protect its visitors? The tool checks HSTS, Content-Security-Policy, X-Frame-Options, other headers and cookies and gives a grade.
The tool could not be loaded. It needs JavaScript: please enable it or reload the page.
Check security headers
Result
Headers
Cookies
The page sets no cookies on the first visit.
| Cookie | Secure | HttpOnly | SameSite |
|---|
Grade: A+ from 95 points, A from 85, B from 70, C from 55, D from 40, otherwise F. Without HTTPS the grade is F. The weighting is droppy24's own, not a standard.
Frequently asked questions
How is the grade calculated?
The starting point is 100 points. Missing or weak headers cost points, most of all a missing Content-Security-Policy and HSTS. The weighting is droppy24's own, not an official standard.
Which headers matter most?
HSTS enforces HTTPS, the Content-Security-Policy makes injected scripts harder, and X-Frame-Options or frame-ancestors prevents the page from being invisibly embedded in other pages.
More tools in this category
- My IP address Show your public IPv4 and IPv6 address.
- DNS lookup Query A, AAAA, MX, TXT and other records.
- Check email security Check a domain’s SPF, DMARC, DKIM and MX.
- Check an SSL certificate Validity, issuer and chain of a website.
- HTTP headers & redirects Response headers and redirects of an address.
- Domain Whois Who owns a domain and when it expires.