Security Headers Checker

Scan a website with Mozilla HTTP Observatory to get its security headers grade, score and passed or failed tests.

Enter any public website to get its HTTP Observatory grade. Or try one of these:

Headers that matter and good values

default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'

Lists where scripts, styles and other files may load from, which blocks most injected scripts (XSS). The Observatory marks it down when script-src allows 'unsafe-inline' or data:, when sources are as broad as https:, or when object-src is not restricted.

max-age=63072000; includeSubDomains

Tells browsers to use HTTPS only for this site. The Observatory expects a max-age of at least six months (15768000 seconds). Add preload only when every subdomain works over HTTPS.

nosniff

Stops browsers from guessing a file type, so a text upload cannot be run as a script. nosniff is the only valid value.

X-Frame-Options: DENY (or SAMEORIGIN), or CSP frame-ancestors 'none' (or 'self')

Stops other sites from loading your pages in a frame, which prevents clickjacking. frame-ancestors is the modern form and wins when both are set.

strict-origin-when-cross-origin (or no-referrer, same-origin, strict-origin)

Controls how much of your URL is sent to other sites when a visitor follows a link. These four values keep paths and query strings private.

camera=(), microphone=(), geolocation=()

Switches off browser features your site does not use, so an injected script or embedded frame cannot ask for them. The Observatory does not grade this header, but it is still worth setting.

Secure; HttpOnly; SameSite=Lax (session cookies)

Secure keeps cookies on HTTPS, HttpOnly hides session cookies from scripts, and SameSite limits cross-site requests (CSRF). A __Host- name prefix adds more protection.

Example

Input: mozilla.org

Result: Grade B, score 75, 10 of 12 tests passed, 2 failed, HTTP status 200

A real Mozilla HTTP Observatory scan run on September 25, 2026. The result changes whenever the site changes its headers, so a new scan may differ.

HTTP Observatory Score to Grade

Score	Grade
100 or more	A+
90 to 99	A
85 to 89	A-
80 to 84	B+
70 to 79	B
65 to 69	B-
60 to 64	C+
50 to 59	C
45 to 49	C-
40 to 44	D+
30 to 39	D
25 to 29	D-
0 to 24	F

Scores start at 100 and can reach 145 with bonus points. Source: MDN HTTP Observatory scoring docs.

Type a domain name or paste a full URL into the Website address box.
Tap Scan headers. Only the domain name is sent to Mozilla HTTP Observatory.
Read the grade, the score and how many tests passed or failed.
Open the full report on MDN to see each test, the header values found and how to fix failures.
Use the header reference below the tool to choose good values for any missing headers.

How Security Header Grades Work

This checker scans a website with Mozilla HTTP Observatory and gives it a grade from A+ to F. The grade reflects the security headers the site sends, such as Content-Security-Policy and Strict-Transport-Security. You also get the score, how many tests passed and a link to the full report on MDN.

Security headers are short instructions a server adds to each response. They tell the browser to use HTTPS only, to refuse to show the page inside another site's frame, or to run scripts only from trusted places. They do not fix bugs in your code. They limit the damage when something slips through, such as an injected script. The reference under the tool lists the headers that matter most and what a good value looks like.

Scoring starts at 100. Missing or weak headers take points away, and some strict setups earn bonus points, up to 145. A score of 90 to 99 is an A, 70 to 79 is a B, and anything under 25 is an F. An A+ is a good sign, but it is not a full security audit. The Observatory does not test for outdated software, SQL injection or weak passwords.

Only the domain name leaves your browser. It goes to Mozilla, whose servers load the site and run the tests. IP addresses, localhost and private names cannot be scanned, because Mozilla has to reach the site over the public internet. A site can get a fresh scan once every 60 seconds, so a repeat check inside that minute returns the same result. Each domain's scan history is public on MDN. To inspect the certificate itself, use the SSL Certificate Checker. If the scan reports an odd status code, the HTTP Status Codes reference explains it.

Sources

Frequently Asked Questions

An A (90 to 99) or A+ (100 or more) means the main headers are in place and set strictly. A B or C usually means one or two headers are missing or too loose, most often the Content-Security-Policy. Treat the grade as a to-do list rather than a verdict. The full report on MDN shows which tests failed and how many points each one cost.

HTTPS protects the connection, but this grade is about headers. A site with a valid certificate and no security headers loses points for each one that is missing, such as Content-Security-Policy, HSTS and X-Frame-Options. example.com, for instance, scored 10 and an F in our test. Adding the missing headers in your server or hosting settings can lift the grade quickly.

Set them where your responses are built. On nginx that is an add_header line, and on Apache a Header set line. Most hosts and CDNs, including Netlify, Vercel, Firebase and Cloudflare, let you define headers in a config file or dashboard. Start with X-Content-Type-Options, Referrer-Policy and HSTS, which rarely break anything. Roll out Content-Security-Policy last, ideally in report-only mode first.

Mozilla allows one new scan per site every 60 seconds. If you scan again within that minute, you get the stored result, so the scan time does not change. Wait a minute after you deploy new headers, then scan again. Also check that your CDN is not serving an old cached copy of the page without the new headers.

No. Mozilla runs the scan from its own servers, so the site must be reachable on the public internet under a domain name. The tool rejects IP addresses, localhost and private names such as .local before sending anything. For a staging site, give it a public domain name for the test, or read the headers in your browser developer tools instead.

Related Tools

SSL Certificate Checker URL Parser

Check any website SSL/TLS certificate: validity, days until expiry, issuer, SANs, TLS version, and fingerprints.

Security and Encryption

HTTP Status Codes Reference

Search and browse over 60 HTTP status codes grouped by class, each with its official name and a plain description.

Web and SEO Tools

URL Parser

Break down URLs into protocol, host, port, path, query parameters, and hash components.

Developer Tools

Meta Tag Generator

Generate HTML meta tags for SEO, Open Graph, and Twitter Cards with a live preview of search and social results.

Web and SEO Tools

Wayback Machine Checker

See when a site or page was first archived by the Wayback Machine, plus its latest snapshot and one near any date.

Web and SEO Tools

Security Headers Checker