Security headers checker
Grade the HTTP security headers of a website, see what its server reveals about itself, and check the flags on the cookies it sets.
Why security headers matter
Security headers are instructions a website sends with every page, telling browsers to always use HTTPS, refuse to be framed by other sites, or block scripts from unexpected places. They cost nothing and close common attacks.
How the grade works
We check six headers on the home page over HTTPS. Six present is an A, five a B, and so on down to F. A missing Content-Security-Policy is common, because writing one takes care, but it is the most valuable of the six.
Questions
- Do cookies need the Secure and HttpOnly flags?
Session and login cookies should have Secure (only sent over HTTPS), HttpOnly (hidden from scripts) and a SameSite value. Cookies that scripts must read, such as some CSRF tokens, are an exception to HttpOnly.
- Should I hide the Server and X-Powered-By headers?
Revealing exact software versions helps attackers pick exploits. It is not a vulnerability in itself, but there is no benefit in announcing it.
- Why does this only show some cookies?
We list the cookies the server sets when the home page loads. Cookies that scripts set in the browser later, such as analytics cookies after consent, are not visible to this check.