First CH Apps / Security Header Grader
Enter a URL and we fetch its HTTP response headers on our server, then grade the six main security headers out of 100 and give an A–F verdict. Values are inspected too — a permissive CSP or a short HSTS max-age costs points — and every gap comes with a recommended value.
This app looks only at HTTP response headers. Page content such as title, meta description and OGP belongs to the Meta Tag & SEO Basics Check, and AI-search scoring belongs to the GEO Checker.
The total is 100 points. Presence alone is not enough — the value is inspected as well.
| Content-Security-Policy (30) | 18 for an enforced policy, +4 for default-src or script-src, +4 when script-src has no bare 'unsafe-inline' (a nonce or hash alongside it counts), +2 for object-src 'none', +2 for base-uri. Report-Only alone scores 6 because nothing is enforced. |
|---|---|
| Strict-Transport-Security (20) | 10 for the header, +6 for a max-age of at least 31536000 (+3 for at least a day), +3 for includeSubDomains, +1 for preload. Zero when the page is served over HTTP. |
| X-Content-Type-Options (12) | Full marks for nosniff; 4 for anything else. |
| X-Frame-Options (12) | Full marks for DENY, 11 for SAMEORIGIN. A restrictive CSP frame-ancestors earns full marks even without this header, since it is the successor. The obsolete ALLOW-FROM scores 5. |
| Referrer-Policy (13) | Full marks for no-referrer, same-origin, strict-origin or strict-origin-when-cross-origin; 8 for the origin family; 2 for unsafe-url. |
| Permissions-Policy (13) | 9 for the header, +4 when camera, microphone and geolocation are all listed. The obsolete Feature-Policy alone scores 5. |
Grade boundaries: A: 100–90 / B: 89–75 / C: 74–60 / D: 59–45 / E: 44–30 / F: 29 and below. Pages served over HTTP are capped at D.
This is a mechanical check of headers. Full marks do not mean the application behind them is safe, and some pages — widgets meant to be embedded, for instance — have good reason to be more permissive.
CSP is the header most likely to break an existing site. Deploy it as Content-Security-Policy-Report-Only first, watch the violations, then switch to enforcing.
Add includeSubDomains and preload to HSTS only after every subdomain serves HTTPS; an HTTP-only subdomain becomes unreachable once they are set.
If a CDN or WAF sits in front of the site, headers may be added or overwritten there. When a change does not show up, check each hop of the delivery path.
Sent: only the URL you type. Our server (Cloudflare Workers) issues a single public GET for it. No cookies or credentials are sent.
Stored: nothing. The grading lives entirely inside one request and writes neither the URL nor the result to any database (no KV, no D1). It leaves memory when the request ends.
Returned: the grade plus the values of the specific headers listed above, each truncated at 500 characters. The page body is never returned, so this app cannot be used to browse other sites through us.
Note: public GET only. URLs pointing at internal networks, localhost or private IPs are rejected. Pages behind a login, or sites that vary their response by client, may not grade correctly.
POST /headers/api/inspect with JSON ({"url": "https://example.com/"}) or a form body and you get the same report back as JSON.