Web-PSQC
Performance
Global load speed Core Web Vitals (Lighthouse) Mobile experience Load test (k6)
Security
SSL/TLS security (testssl.sh) TLS configuration (SSLyze) Security headers Vulnerability scan (OWASP ZAP) CVE scan (Nuclei)
Quality
Accessibility (WCAG) Browser compatibility Responsive layout
SEO
SEO essentials Meta tags & link previews Structured data Crawlability: robots.txt & sitemap Site crawl & broken links Google presence
AI visibility
AI crawler access AI answer readiness What AI says about you
Web-PSQC
Pricing Certificate Blog Sign in Test a website

HTTP security headers test

Security headers tell browsers how to protect your visitors from cross-site scripting, clickjacking, protocol downgrades and data leaks. This test reads the response headers of your page, checks each important header and how strict its value is, and shows the exact header to add when one is missing or weak. It takes about five seconds and needs nothing installed on your site.

Runs only this test. Want everything? Run all 18 tests from the home page.

What this test checks

Strict-Transport-Security (HSTS)

Whether browsers are told to use HTTPS only, with a max-age of at least 180 days and includeSubDomains.

Content-Security-Policy (CSP)

Whether a CSP is enforced and how strict it is: unsafe-inline without a nonce or hash, unsafe-eval, wildcard script sources, and missing object-src or base-uri.

Clickjacking protection

X-Frame-Options set to DENY or SAMEORIGIN, or a CSP frame-ancestors directive without wildcards.

X-Content-Type-Options

The nosniff value, which stops browsers from guessing file types and running mislabeled files as scripts.

Referrer-Policy and Permissions-Policy

Whether full URLs leak to other sites, and whether browser features such as camera, microphone and geolocation are restricted.

Cross-Origin-Opener-Policy

Optional hardening that isolates your window from pages opened in popups.

Software version disclosure

Server, X-Powered-By and X-AspNet-Version headers that reveal exact software versions to attackers.

Cookie flags and mixed content

Secure, HttpOnly and SameSite on cookies the page sets, and scripts, styles, frames or images loaded over plain HTTP.

Sample result

A real result for devteam.co.kr, tested 17 hours ago.

Security headers

7 of 9 security header checks passed, 1 missing or unsafe.

82/100B
Content-Security-Policy (CSP) (Problem)
No Content-Security-Policy. It is the main browser-side defense against cross-site scripting (XSS).
Missing
Target: Restricts scripts; no unsafe-inline without nonce/hash
How to fixStart with a policy such as: default-src 'self'; script-src 'self' (plus the domains you load scripts from); object-src 'none'; base-uri 'self'; frame-ancestors 'self'. Test it in report-only mode first.
Strict-Transport-Security (HSTS) (Good)
Browsers will only ever connect to this site over HTTPS.
180 days, subdomains, preload
Target: max-age ≥ 15552000 (180 days); includeSubDomains
Clickjacking protection (Good)
Other sites cannot embed your pages in a hidden frame.
SAMEORIGIN
Target: X-Frame-Options: SAMEORIGIN or CSP frame-ancestors
X-Content-Type-Options (Good)
Browsers will not guess file types, which blocks some content-injection attacks.
nosniff
Target: nosniff
Referrer-Policy (Good)
Full URLs are not leaked to other sites.
strict-origin-when-cross-origin
Target: strict-origin-when-cross-origin
Permissions-Policy (Good)
Browser features such as camera and geolocation are restricted.
Set
Target: Disable unused features (camera, microphone, geolocation…)

Response headers we read

servercloudflare
referrer-policystrict-origin-when-cross-origin
x-frame-optionsSAMEORIGIN
permissions-policygeolocation=(), microphone=()
x-content-type-optionsnosniff
strict-transport-securitymax-age=15552000; includeSubDomains; preload

How it works

  1. Our test server in Virginia, USA, requests the URL you enter, follows up to 5 redirects and reads the headers of the final response.
  2. Every redirect hop is checked first: only http and https on ports 80 and 443 are allowed, and the host must resolve to public IP addresses.
  3. The HTML of that response is also scanned for scripts, stylesheets, frames and images that load over plain HTTP.
  4. The request identifies itself as WebPSQCBot, and the whole check usually takes about 5 seconds.

How it is scored

The score uses our item-weighted formula: a pass earns full credit, a warning half and a fail none, with HSTS and mixed content weighted 3×, CSP, clickjacking protection, nosniff and cookie flags 2×, and Referrer-Policy, Permissions-Policy, COOP and version disclosure 1×. A missing COOP header is noted but not scored, and the cookie and mixed-content checks apply only when the page sets cookies or is served over HTTPS.

CheckGoodNeeds workPoor
HSTSmax-age 180+ days with includeSubDomainsShorter max-age, or no includeSubDomainsMissing, or site not on HTTPS
Content-Security-PolicyStrict policySet, but with weak spotsMissing or report-only
Clickjacking protectionDENY, SAMEORIGIN or frame-ancestors—Missing
X-Content-Type-Optionsnosniff—Missing
Referrer-Policystrict-origin-when-cross-origin or stricterMissing or unusual valueunsafe-url or no-referrer-when-downgrade
Cookie flagsSecure, HttpOnly and SameSite on every cookieSome flags missing—
Mixed contentEverything over HTTPSImages over HTTPScripts, styles or frames over HTTP

Grades: A+ 95–100 · A 90–94 · B 80–89 · C 70–79 · D 60–69 · F below 60.

FAQ

What are HTTP security headers?
They are response headers that tell the browser how to handle your page safely: use HTTPS only (HSTS), which scripts may run (Content-Security-Policy), whether other sites may frame the page (X-Frame-Options) and more. They cost nothing to add and are set in your web server, CDN or application.
How do I add security headers in nginx or Apache?
In nginx, add lines such as add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; inside the server block. In Apache, use Header always set with the same header names and values. Many CDNs, including Cloudflare, can also add response headers for you.
Why does my site fail the Content-Security-Policy check?
The check fails when no CSP is sent, or when only a report-only policy is set, because that blocks nothing. A policy that allows unsafe-inline scripts without a nonce or hash, allows unsafe-eval or wildcard sources, or lacks object-src 'none' and base-uri gets a warning. A nonce-based policy with 'strict-dynamic' passes even when it lists https: and unsafe-inline as fallbacks for old browsers, because modern browsers ignore them. Test a new policy in report-only mode first so it does not break your pages.
Is X-Frame-Options still needed if I have a CSP?
Not if your CSP includes a frame-ancestors directive without wildcards, which this test accepts as clickjacking protection. Otherwise, send X-Frame-Options: SAMEORIGIN (or DENY).
What HSTS max-age should I use?
Use at least 15552000 seconds (180 days); 31536000 (one year) is the common choice. Add includeSubDomains once every subdomain supports HTTPS, and add preload only when you are ready to submit the domain to the browsers' HSTS preload list.