- Web technical
- Web security
SecurityHeaders: an A+ to F grade for a website’s security headers
Reference
You paste a site’s URL, click “Scan,” and SecurityHeaders displays a big letter, from A+ to F, that sums up the protections the site asks browsers to enforce. Below the grade, the report lists the HTTP headers that are present and those that are missing (HSTS, Content-Security-Policy, X-Frame-Options and a few others), each with a short explanation. Free and with no sign-up, it is the best-known security header test on the web, the one developers and auditors run to get a first assessment in a few seconds.
What is SecurityHeaders?
With every response, a web server sends the browser HTTP headers that visitors never see. Some of them are there for security: enforcing HTTPS (Strict-Transport-Security), restricting which scripts are allowed on the page (Content-Security-Policy), preventing the site from being displayed inside a third-party frame (X-Frame-Options), stopping the browser from guessing a file’s type (X-Content-Type-Options), controlling what information is passed to other sites (Referrer-Policy) or cutting off access to the camera and microphone (Permissions-Policy). SecurityHeaders queries the requested URL, follows redirects if you want it to, and checks for these six headers. All of them present means A+; none means F. A content policy that is too permissive, allowing inline scripts, caps the grade at A and triggers a warning.
The report doesn’t stop at the grade. It shows the full list of headers returned by the server, flags in blue those that reveal too much about the installed software (Server, X-Powered-By), comments on the headers found and presents “upcoming headers” such as Cross-Origin-Embedder-Policy. A checkbox lets you keep your scan off the list of recent scans, which is public by default and sits on the homepage next to a “Hall of Fame” and a “Hall of Shame.”
The tool was launched in February 2015 by Scott Helme, a British security researcher, initially at securityheaders.io; grades, modeled on those SSL Labs gives for encryption, arrived in December of that year. The counter passed 250 million scans in 2023 and showed more than 400 million in October 2026, nearly half of them graded F. In June 2023, the site joined Probely, a Portuguese security testing company that had sponsored it since 2020, which was itself acquired by the American company Snyk in November 2024. Scott Helme remains involved in the project. The paid API, however, was shut down in 2026: no subscriptions are sold or renewed anymore.
SecurityHeaders at a glance
- Type
- Online test, no account
- Launched
- February 2015
- Creator
- Scott Helme, security researcher
- Origin
- United Kingdom
- Owner
- Snyk (Probely acquisition, 2024)
- Headers graded
- Six, from HSTS to Permissions-Policy
- Scans run
- More than 400 million (October 2026)
- Free plan
- Yes, the entire service
- Starting price
- Free
What is SecurityHeaders used for?
-
Grade your site’s protections
a letter from A+ to F that shows at a glance how many security headers your server sends.
-
Know what to add
each missing header is explained in two sentences, with a link to its documentation so you can set it up.
-
Spot an overly permissive CSP
inline scripts or code evaluation allowed in your content policy trigger a warning and cap the grade.
-
Read the raw headers
the server’s full response, with the headers that give away your software or its version flagged separately.
-
Get ahead of upcoming headers
cross-origin isolation protections, such as Cross-Origin-Embedder-Policy, presented before they count toward the grade.
SecurityHeaders review
Reference
SecurityHeaders tells you in ten seconds whether a site has thought about its security headers, and nobody makes it simpler. The letter speaks to everyone, red and green need no training to read, and each gap comes with an explanation clear enough to forward as is to the hosting provider or the developer. That “report card” feel is intentional: you want to bring your C up to an A, and that is often what finally gets people to configure HSTS or a content policy.
The letter measures less than you might think. It mostly counts headers present or missing; it doesn’t tell you whether the content policy actually protects anything, and it doesn’t test the certificate, the cookies or the application’s vulnerabilities. An A+ doesn’t make a site safe, and a C doesn’t make it vulnerable: Google’s own homepage got a C in October 2026. For sites built on a CMS or on shared hosting, aiming for A+ sometimes takes more work than the benefit justifies, especially on the CSP side.
Chasing the grade has its pitfalls, too. A content policy copied from an example blocks the site’s third-party scripts, whether analytics, consent banner or payment module, and breaks it without warning: deploy it first in Report-Only mode, which SecurityHeaders doesn’t count toward the grade, then tighten it once you have reviewed the violations. The same caution applies to HSTS: the includeSubDomains and preload options commit every subdomain for months, and a subdomain without HTTPS becomes unreachable.
Finally, the service isn’t quite what it used to be. The API closed in 2026, which means reworking the continuous integration pipelines and monitoring dashboards that relied on it, and the site, now filtered against bots, no longer lends itself to scripts. There is no account, no history and no alerts, and Snyk hasn’t said anything about its plans for the tool. For a one-off manual check, it still does the job perfectly.
Strengths
- Free, with no account and no stated limit.
- A grade a non-specialist can read, useful for convincing a client or a decision-maker.
- An explanation for each missing header, with what you need to set it up.
- Raw headers, server information leaks and upcoming headers in the same report.
- An option to hide your scan from the public list.
Weaknesses
- A grade based mostly on whether headers are present, not on how well they are configured.
- Nothing on the certificate, cookies or application vulnerabilities.
- No API since 2026: the grade can no longer be retrieved by a script, so automation requires another tool.
- No history, no monitoring and no alerts if something regresses.
- An uncertain future since the Snyk acquisition.
Is SecurityHeaders worth it?
Yes, if you have just changed the configuration of a server, a CDN or a hosting plan and want to check instantly what browsers receive. It also comes in handy for a first look at a site you have taken over for maintenance, or for illustrating an audit with a grade everyone understands.
Not necessarily, if you want to automate the check or analyze your content policy in detail. Mozilla’s HTTP Observatory, also free, reviews the CSP and cookies, keeps a history and still offers an API. Google’s CSP Evaluator helps harden a content policy, Qualys SSL Labs handles the certificate and encryption, and Report URI collects the violations browsers report once the CSP is in place. Finally, watch out for sites with similar names that copy the same interface.
How much does SecurityHeaders cost?
The online scan is completely free, with no account and no stated quota, and SecurityHeaders no longer sells any plan: the API subscription, its only paid offer, is no longer sold or renewed.
| Plan | Per month | Included | Who it's for |
|---|---|---|---|
| Free | $0 | Online scans with no stated quota, full report | Developers, sysadmins, auditors, site owners |
Source: official SecurityHeaders About page, checked on October 31, 2026.
- No pricing page: the publisher presents the tool as free.
- The paid API, shut down in 2026, no longer accepts new subscriptions; existing subscribers can no longer renew.
FAQ
Answers to questions about SecurityHeaders
Is SecurityHeaders free?
Yes. The scan runs online, with no account, and the publisher no longer sells any plan since it shut down its API.
How do you get an A+ grade?
The server has to send the six headers checked: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, without allowing inline scripts in the content policy, which caps the grade at A.
Does a bad grade mean my site can be hacked?
No. The grade measures extra protections requested from the browser, not the absence of vulnerabilities. A site graded F can be sound, and a site graded A+ can be vulnerable in other ways.
Does the SecurityHeaders API still work?
No. Its shutdown was announced in 2025 for April 2026, and the official page says the service has been discontinued. To automate checks, the free API of Mozilla’s HTTP Observatory is the closest alternative.
Are my scan results public?
By default, the scanned site appears in the list of recent scans on the homepage. Just check “Hide results” before running the scan to avoid that.
Information checked on October 31, 2026