Each security header gets a pass, a warning or a fail, with the exact line to add. Check the headers your website sends, or paste headers you already have, and see how well your site is protected. It is free and needs no account.
How to check your headers
- On the Check a URL tab, enter your site in Web address and press Check headers.
- Or open the Paste headers tab, paste the Response headers, and press Grade these headers.
- Read the grade, then go through each line. Every problem comes with the line to add.
What gets sent
Browsers can’t read another site’s headers, so when you use Check a URL, the address you enter is fetched by Snowkit’s server. It follows up to 5 redirects, gives up after 8 seconds, refuses private and local network addresses, and doesn’t store what you check. Pasted headers are graded in your browser and are not sent anywhere.
The headers that matter most
Strict-Transport-Security makes browsers use HTTPS for your site every time. Content-Security-Policy lists where scripts, styles and frames may come from, so injected code has a hard time running. X-Frame-Options or CSP frame-ancestors stops other sites from loading yours in a hidden frame. X-Content-Type-Options: nosniff stops browsers guessing file types, and Referrer-Policy and Permissions-Policy limit what leaks to other sites and which browser features pages can use.
How the grade works
Every check starts as a pass. HTTPS, HSTS and CSP count most; frame protection, nosniff and cookie flags count next; referrer and permissions policies and version numbers in headers count least. A warning costs half as much as a fail. The grade is a quick summary, so read each line: a strict CSP with a short HSTS time can still be a very well protected site.
Where to set headers
On Cloudflare Pages and Netlify, add them to a _headers file. On Vercel, use the headers section of vercel.json. With nginx use add_header, with Apache use Header always set, and in Node frameworks a small middleware works. Set them on every HTML response, not only the homepage.
Tips
- Add one header at a time and test your site after each, since a strict Content-Security-Policy can block things that were working.
- Start with the easy wins: nosniff, a referrer policy and frame protection.
- Check again after you change your hosting or add a new service.
- Look at the DNS and email setup too, with the DNS lookup.
Who uses it
Website owners and small business owners, freelancers handing over a site, and developers reviewing security before a launch. For turning a request into code, see the curl converter.
Questions
Does a good grade mean my site is secure?
No. Headers are one layer of protection. They do not replace updates, strong passwords or careful code.
Why can I not check a local address?
Private and local network addresses are refused. Paste the headers instead to grade them in your browser.
Does it store my site address?
No. What you check is not stored.