FREE THOUGHT · FREE SOFTWARE · FREE WORLD

Scan any URL's HTTP security headers: HSTS, Content-Security-Policy, X-Content-Type-Options, clickjacking protection, Referrer-Policy, Permissions-Policy, cookie flags and version leaks. You get a grade, what each header means, and the exact Header lines to paste into .htaccess.

Follows up to 5 redirects and grades the final page. Only public addresses on ports 80, 443, 8080 and 8443; results are cached for two minutes.

Build a complete file with the .htaccess generator, and check the certificate with the SSL checker.

HTTP response headers are the cheapest security you'll ever ship. A handful of lines tell the browser: never downgrade to HTTP, never sniff a JSON file into a script, never let another site frame me, never send my URLs to strangers. Most sites send none of them. Paste a URL here and find out which camp you're in.

How the grade works

The server fetches your page (following redirects, same SSRF guards as every AskApache tool) and grades the final response from A+ to F. Each header gets a line: present or missing, what the value actually does, and a fix you can paste.

  • Strict-Transport-Security: forces HTTPS for max-age seconds. Under six months doesn't count for much.
  • Content-Security-Policy: the big one. Graded hard: 'unsafe-inline' or * in script-src knock it down, because a CSP that allows inline script stops almost nothing.
  • X-Content-Type-Options: nosniff: no guessing content types.
  • Frame protection: frame-ancestors in CSP, or the older X-Frame-Options. Stops clickjacking.
  • Referrer-Policy: strict-origin-when-cross-origin is the sane default.
  • Permissions-Policy: switch off camera, mic, geolocation and friends you never use.
  • Cross-Origin-Opener-Policy and friends, as bonus points.

It also flags headers that leak: Server: Apache/2.4.58 (Ubuntu), X-Powered-By: PHP/8.3.1. You're handing out the exact version to look up in an exploit database. Stop it.

The headers I'd ship today

<IfModule mod_headers.c>
  Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
  Header always set X-Content-Type-Options "nosniff"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
  Header always set Content-Security-Policy "frame-ancestors 'self'; object-src 'none'; base-uri 'self'"
  Header always unset X-Powered-By
</IfModule>
ServerTokens Prod
ServerSignature Off

always matters: without it, Apache drops these on 404s and 500s, which are exactly the pages attackers poke at. ServerTokens only works in the main server config, not .htaccess.

Rolling out a real CSP without breaking everything

Ship it as Content-Security-Policy-Report-Only first. The browser logs every violation to the console and changes nothing. Fix your inline scripts (move them to files, or use nonces), watch for a week, then switch the header name. The starter line above is safe to ship today; it blocks framing, plugins and <base> hijacks without touching your scripts.

FAQ

Is X-XSS-Protection still a thing?

No. Browsers removed the XSS auditor, and the header could be abused to create holes. Send 0 or nothing. CSP replaced it.

I set the headers but the checker doesn't see them.

Your CDN or a PHP app may be overwriting them, or you set them without always and the page is a redirect. Check each hop with the redirect checker, which shows headers per response.

Where else should I look?

The SSL checker covers the TLS side, and the .htaccess generator writes all of the above for you.