Check security headers
Paste a page address. We read its HTTP headers, check the nine protections that matter, and give a score you can recompute by hand.
How the score is calculated
The score is a sum, not an estimate. Each check is worth a fixed number of points; a passed check earns all of them, a partial check half (rounded down: 7 out of 15), a missing check none. With the headers shown above, you can reach the same total by hand.
| Check | Points | Why this weight |
|---|---|---|
| HTTPS | 20 | without it, no other protection holds |
| Content-Security-Policy | 20 | the only one that limits the damage of an XSS flaw |
| Strict-Transport-Security | 15 | stops visitors from being pushed back to http:// |
| Framing protection | 10 | stops your page from being hidden in a frame to trick visitors into clicking |
| X-Content-Type-Options | 10 | stops the browser from guessing a file's type |
| Referrer-Policy | 10 | limits what your addresses reveal to other sites |
| Permissions-Policy | 5 | cuts off access to the camera, microphone or location |
| Secure and SameSite cookies | 5 | stops a cookie from travelling in clear or serving a forged request |
| Server version hidden | 5 | opens no flaw, but helps someone look for one |
The letter follows the total: A+ at 100, A from 90, B from 75, C from 60, D from 45, E from 30, F below.
Where to start
The one-line headers (X-Content-Type-Options, Referrer-Policy, X-Frame-Options) take a few minutes to add in the server or hosting configuration, with no risk to the site. HSTS too, provided the whole site is already served over HTTPS. The CSP needs more care: a policy that is too strict breaks third-party scripts. Start it in report mode, look at what it would have blocked, then enforce it.
What this tool does not do
- It tests no vulnerability: it reads the headers the server sends to everyone, and nothing else.
- It judges only one page. A site can send different headers on different pages, especially between the home page and the customer area.
- It does not tell you whether the CSP is well tuned for your site: it checks that it exists and protects against scripts, not that it lets through the ones you need.
Frequently asked questions
Does a low score hurt my rankings?
Not directly: only HTTPS is a ranking signal, and a minor one. The other headers protect your visitors, not your position. But a hacked site is removed from results or flagged as dangerous, and these headers are part of what protects it.
How do I add these headers?
In the server configuration (Apache, Nginx), in the dashboard of a service such as Cloudflare, or through a plugin on WordPress. With most shared hosts, a .htaccess file is enough for the simple headers.
Why does the page not show cookie values?
Because those cookies were set for our visit and would tell you nothing. Only their name and attributes (Secure, HttpOnly, SameSite) matter for security, and those are the only things we keep.
Going further
HTTPS and SEO: what it actually changes Four concrete things change when a site moves to HTTPS. Ranking is the smallest of them, and the one everybody talks about.The other tools
Check an SSL certificate
Certificate expiry date, issuer, and the names it actually covers.
Check SPF, DKIM and DMARC
SPF, DKIM and DMARC read and assessed, including the chain of ten SPF lookups, with the Gmail and Yahoo requirements.
Can my page be indexed?
Noindex, robots.txt, canonical, HTTP status: what stops Google and Bing from indexing a page, engine by engine.
Be warned before the certificate gives out
Expansel checks the HTTPS certificate of your sites on every pass, and warns you before it expires, not on the day the browser shows your visitors a red warning.