The Security Headers Checker fetches a URL and grades the HTTP security headers in its response: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options and seven more. It is non-intrusive and needs no sign-up. Run it at vigilbase.com/tools/security-headers.
Run a check
Enter a URL or domain. If you leave out the scheme,
https://is assumed.Complete the security check and run the scan.
Read the result. Each header shows its value, a status and a recommendation.
Email the report, optionally. Enter a work email under the result. See Report by email.
The scanner reads the final response. If the site answers with a bot verification challenge or an HTTP error status, the check stops and assigns no grade.
How each header is scored
Each header gets a score out of 10 and a weight. A missing header scores 0.
| Header | Weight | Full marks | Points lost |
|---|---|---|---|
| Content-Security-Policy | 20 | A policy with no weaknesses | 'unsafe-eval' 4, 'unsafe-inline' for scripts 3, a script wildcard * 2, data: in script sources 2, no default-src 1, no frame-ancestors 1 |
| Strict-Transport-Security | 20 | max-age of a year or more with includeSubDomains and preload | max-age under a year 3, and under a day 3 more; no includeSubDomains 1; no preload 1 |
| X-Frame-Options | 10 | DENY (10) or SAMEORIGIN (9) | ALLOW-FROM scores 6; another value scores 2 |
| X-Content-Type-Options | 10 | nosniff | Another value scores 2 |
| Referrer-Policy | 10 | no-referrer (10) or strict-origin-when-cross-origin (9) | Other strict values score 8; unsafe-url and no-referrer-when-downgrade score 5 |
| Permissions-Policy | 10 | Present, starting at 8 | Allowing camera or microphone for every origin 2 each, geolocation 1 |
| Cross-Origin-Opener-Policy | 5 | same-origin (10) | same-origin-allow-popups scores 8, unsafe-none 4 |
| Cross-Origin-Embedder-Policy | 5 | require-corp (10) | credentialless scores 8, unsafe-none 4 |
| Cross-Origin-Resource-Policy | 5 | same-origin (10) | same-site scores 9, cross-origin 5 |
| X-XSS-Protection | 5 | Not set, or 0 | 1; mode=block scores 8 |
X-XSS-Protection is deprecated, so leaving it out is the recommended state and counts as full marks. For Permissions-Policy, the older Feature-Policy header is read when Permissions-Policy is absent.
A CSP weakness counts only when it affects scripts: 'unsafe-inline' in style-src does not, and 'unsafe-inline' is ignored when the same directive has a nonce, a hash or 'strict-dynamic', as browsers do. When a site sends several CSP headers, a script weakness counts only if every policy allows it.
How the grade is calculated
The weighted header scores add up to a score out of 100.
| Grade | Score |
|---|---|
| A+ | 90 or more |
| A | 80-89 |
| B | 65-79 |
| C | 50-64 |
| D | 35-49 |
| F | Below 35 |
Findings get a severity from the header's importance: a missing CSP or HSTS header is high, a missing X-Frame-Options, X-Content-Type-Options, Referrer-Policy or Permissions-Policy is medium, and the cross-origin headers are low.
The status is Vulnerable for grade F or more than three high-severity findings, Warnings for grade C or D or any high-severity finding, and Secure otherwise.
Fix common findings
Content-Security-Policy missing
Add a policy with default-src as a fallback and frame-ancestors. Start as Content-Security-Policy-Report-Only to test it. The CSP generator builds one.
Content-Security-Policy contains 'unsafe-inline' or 'unsafe-eval'
Replace 'unsafe-inline' with nonces or hashes, and remove 'unsafe-eval'. The CSP evaluator explains each weakness in detail.
Strict-Transport-Security missing or short
Send Strict-Transport-Security: max-age=31536000; includeSubDomains once every subdomain serves HTTPS. Check preload readiness with the HSTS checker.
X-Frame-Options missing
Send X-Frame-Options: DENY, or SAMEORIGIN if your own pages frame each other.
X-Content-Type-Options missing
Send X-Content-Type-Options: nosniff.
Referrer-Policy missing
Send Referrer-Policy: strict-origin-when-cross-origin or a stricter value.
Permissions-Policy missing
Turn off features you do not use, for example Permissions-Policy: camera=(), microphone=(), geolocation=().
Run it from code
The check is on the anonymous Agent API and in the CLI:
npx @vigilbase/cli headers https://example.com