Free · no signup
Security Header Checker
Scan any site’s HTTP response headers, get an A+–F grade, and copy the exact fix for your server.
What security headers are — and why they matter
HTTP security headers are instructions your server sends with every page that tell the browser how to
behave defensively. They are one of the cheapest, highest-leverage protections you can add: no code
change, just configuration. Miss them and you leave the door open to cross-site scripting (XSS),
clickjacking, protocol downgrade and MIME-sniffing attacks.
Content-Security-Policy (CSP)
Controls which scripts, styles and resources may load — the single most effective defense against XSS.
Strict-Transport-Security (HSTS)
Forces HTTPS so a network attacker can’t downgrade visitors to plain HTTP.
X-Content-Type-Options
nosniff stops the browser guessing content types and running files as scripts.X-Frame-Options / frame-ancestors
Blocks your pages being embedded in a hostile iframe (clickjacking).
Frequently asked questions
It sends a request to your website and inspects the HTTP response headers browsers rely on for defense — Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy — then grades how well you are protected.
At minimum: Strict-Transport-Security (HSTS), X-Content-Type-Options: nosniff, a Content-Security-Policy, X-Frame-Options or frame-ancestors, Referrer-Policy and a Permissions-Policy. This tool tells you exactly which are missing and gives you the config to add them.
Yes. It is free, needs no signup, and only scans public websites. CompleteStatus can also monitor your headers continuously and alert you if your grade ever drops.
Don’t check it once — watch it 24/7
Headers drift — a deploy or a new CDN rule can silently drop your CSP. CompleteStatus runs this exact check around the clock and alerts you the moment something changes — before your users (or attackers) notice.
Monitor this free
Try the other free tools
Uptime is table stakes. We watch the rest — security headers, email authentication, certs and DNS, with the fix attached.
Start free
Product
Resources
Account
© 2026 CompleteStatus. All rights reserved.
CompleteStatus — operated in the United States
·
support@completestatus.com