# Security headers checker

Grade a site's HTTP security headers, from HSTS to Content-Security-Policy.

Enter a URL and we read its response headers and grade it against the security headers that harden a visitor's browser session, showing which are present and which are missing.

## What we check

- Strict-Transport-Security (HSTS), which forces browsers to stay on HTTPS.
- Content-Security-Policy, which limits what can run on the page to curb cross-site scripting.
- X-Frame-Options and X-Content-Type-Options, which block clickjacking and MIME sniffing.
- Referrer-Policy and Permissions-Policy, which control what the page leaks and what it can use.

## Why it matters

Security headers are defence in depth. None of them fixes a bug on their own, but together they shut down whole classes of attack: clickjacking, protocol downgrade, content-type confusion, and script injection. They are cheap to add and easy to forget, which is why so many sites are missing them. A missing header is not an outage, so this check stays advisory, but closing the gaps is low-effort, high-value hardening.

## Frequently asked questions

### Is a missing header a serious problem?

It is a weakened defence, not an outage, which is why we flag it as an advisory rather than a failure. Each header you add removes an avenue an attacker could otherwise use.

### Where do I add these headers?

At your web server (Nginx or Apache), a CDN or reverse proxy, or in your application's middleware. Content-Security-Policy in particular is worth rolling out carefully so it does not block your own assets.

### Can Ranetrace watch this for me?

Yes. Ranetrace audits your site continuously and surfaces security and best-practice issues, so a header that gets dropped in a deploy does not stay dropped unnoticed.

## Run this check

Run it on your own domain here: https://ranetrace.com/tools/security-headers

## Related tools

- [SSL/TLS certificate checker](https://ranetrace.com/tools/ssl-checker.md)
- [DNS lookup](https://ranetrace.com/tools/dns-lookup.md)
- [Domain & WHOIS lookup](https://ranetrace.com/tools/domain-lookup.md)

This page is a one-time snapshot. Ranetrace monitors this continuously and warns you before it becomes a problem: https://ranetrace.com/pricing.md