How to use the free security header checker
Grade any site's HTTP security headers (CSP, HSTS, X-Frame-Options, Referrer-Policy) instantly.
Part of Security header monitoring — the full answer, the facts and the alternatives in one place.
Quick answer#
Enter any URL at /tools/security-header-checker to see which headers are set, which are missing, and get an A–F grade with fix suggestions.
What it checks#
Where to find it in Lemwatch#
Public URL: /tools/security-header-checker. Results include copy-paste snippets for nginx, Apache, and Cloudflare Workers.
How to use it#
FAQ#
Why did I get a B when the site looks fine?#
Missing CSP or a wildcard frame-ancestors typically drops the grade one letter. Both are common on WordPress.
Does this test authenticated pages?#
No — only public URLs. For auth-gated pages, use Lemwatch's authenticated monitoring.
Related#
Related Articles
How to use the free SSL certificate checker
Test any public site's SSL cert, chain, expiry, and TLS grade in seconds — no signup required.
How to use the free mixed content checker
Scan any HTTPS page for insecure http:// resources (images, scripts, iframes) that break the padlock.
How to use the free sitemap diff tool
Compare two sitemap snapshots to see added, removed, and modified URLs — great for post-migration audits.
Cookie Compliance Checks
Check if your site properly handles cookie consent and tracking scripts.