What Are HTTP Security Headers?
HTTP security headers are directives sent by web servers that instruct browsers how to handle content. They provide an additional layer of security against common web vulnerabilities.
Essential Security Headers
- Strict-Transport-Security (HSTS): Forces HTTPS connections Forces HTTPS connections
- Content-Security-Policy (CSP): Prevents XSS and injection attacks Prevents XSS and injection attacks
- X-Frame-Options: Protects against clickjacking Protects against clickjacking
- X-Content-Type-Options: Prevents MIME sniffing Prevents MIME sniffing
- Referrer-Policy: Controls referrer information Controls referrer information
- Permissions-Policy: Restricts browser features Restricts browser features
Understanding Our Security Score
We grade your headers from A+ to F based on the presence and configuration of critical security headers. An A+ grade means all recommended headers are properly configured.