How to use the free security header checker
Grade any site's HTTP security headers (CSP, HSTS, X-Frame-Options, Referrer-Policy) instantly.
Quick answer
Enter any URL at /tools/security-header-checker to see which headers are set, which are missing, and get an A–F grade with fix suggestions.
What it checks
- Content-Security-Policy (presence, weak directives)
- Strict-Transport-Security (max-age, includeSubDomains)
- X-Frame-Options / frame-ancestors
- X-Content-Type-Options and Referrer-Policy
- Permissions-Policy and cross-origin isolation headers
Where to find it in Lemwatch
Public URL: /tools/security-header-checker. Results include copy-paste snippets for nginx, Apache, and Cloudflare Workers.
How to use it
- Enter your homepage URL.
- Click Grade headers.
- Read the per-header verdict and severity.
- Copy the recommended config snippet for your server.
- Re-test after deploy to confirm the grade improved.
FAQ
Why did I get a B when the site looks fine?
Missing CSP or a wildcard frame-ancestors typically drops the grade one letter. Both are common on WordPress.
Does this test authenticated pages?
No — only public URLs. For auth-gated pages, use Lemwatch's authenticated monitoring.
Related