Question 1

What are HTTP security headers?

Accepted Answer

HTTP security headers are response headers that instruct browsers how to behave when handling your site. They protect against XSS, clickjacking, MIME sniffing, and other common web attacks.

Question 2

What is Content-Security-Policy (CSP)?

Accepted Answer

Content-Security-Policy controls which resources a browser is allowed to load for your page. A strong CSP prevents cross-site scripting (XSS) attacks by blocking unauthorized scripts.

Question 3

What is HSTS (HTTP Strict Transport Security)?

Accepted Answer

HSTS instructs browsers to always use HTTPS for your site, even if the user types http://. It prevents SSL stripping attacks and forces encrypted connections.

Question 4

How is the security header grade calculated?

Accepted Answer

Each security header carries a weight. Present headers contribute their weight to a 0–100 score. A+ is 90–100, A is 80–89, B is 70–79, C is 60–69, D is 50–59, and F is below 50.

Question 5

What is X-Frame-Options?

Accepted Answer

X-Frame-Options prevents your page from being embedded in iframes on other sites, protecting against clickjacking attacks where users are tricked into clicking hidden elements.

Question 6

Is this tool free to use?

Accepted Answer

Yes, the Security Headers Checker is completely free. No account or registration is required. Simply enter any URL to get an instant grade and per-header analysis.

Security Headers Checker

Frequently Asked Questions