What are HTTP security headers?
A few lines that change how browsers behave
HTTP security headers are instructions that a web server sends with each page. They tell the browser what it may do with the content: which scripts may run, whether the page may be shown inside a frame, whether a connection may fall back to plain HTTP. They cost nothing, need no change to the application code in most cases, and block whole families of attacks.
Because they are set in the server or CDN configuration, headers are easy to forget during a migration or a redesign. A check after each deployment catches the regression before an attacker does.
How this checker works
The checker sends one request to the address you enter, follows redirects to the final page and reads the response headers. It looks for the six headers that browsers act on today and reports each one as present or missing, with the value the site sent.
The grade runs from A to F. Missing Content-Security-Policy or HSTS weighs the most, because these two headers stop the most damaging attacks. The check is passive: it reads what any visitor's browser receives and does not test the site for vulnerabilities.
What a good result does not prove
An A grade means the headers are in place, not that the site is secure. A Content-Security-Policy can be present and still too permissive, and headers do nothing against a SQL injection or a leaked backup file. Use this tool as a quick first check, then run a full scan to test the rest.