Security headers checker: your grade, and how to fix it
Scan your website for free and see every HTTP security header you are missing, explained in plain language with the exact fix. Not just a grade: the way to a better one.
Scan your website free
Get your speed, security, SEO and AI-visibility score in under a minute. No signup.
Run a free scan →What are HTTP security headers?
HTTP security headers are small instructions your server sends with every page. They tell the browser how to protect your visitors: force an encrypted connection, block your site from being framed by scammers, and stop injected scripts from running. Together they are one of the cheapest, highest-impact security wins on the web.
Miss them and you leave the door open to cross-site scripting (XSS), clickjacking and protocol-downgrade attacks. Tools like securityheaders.com give you a letter grade. eighty gives you that same grade and the exact fix, right next to your speed, SEO and AI visibility in one report.
The headers that matter, and what each one does
| Header | What it does | Without it |
|---|---|---|
Strict-Transport-Security (HSTS) | Forces every visit over HTTPS. | Visitors can be silently downgraded to unencrypted HTTP. |
Content-Security-Policy (CSP) | Controls which scripts and resources may load. | Injected scripts (XSS) can steal data and hijack sessions. |
X-Frame-Options | Stops other sites from embedding yours in a frame. | Clickjacking: attackers trick users into clicking hidden buttons. |
X-Content-Type-Options | Stops the browser from guessing file types. | Files can be interpreted as scripts (MIME sniffing). |
Referrer-Policy | Limits what URL data leaks to other sites. | Private URLs and query data leak to third parties. |
Permissions-Policy | Turns off browser features you do not use (camera, mic). | Third-party scripts can quietly request sensitive features. |
How your grade is calculated
A grade from A+ to F is not just about presence, it is about quality. HSTS with a short lifetime scores lower than one with max-age of at least six months plus includeSubDomains. A CSP that still allows 'unsafe-inline' offers little real XSS protection. eighty checks both: which headers exist, and whether they are actually strong.
We also look past headers alone: a valid TLS certificate, an automatic HTTP-to-HTTPS redirect, secure cookie flags (Secure, HttpOnly, SameSite) and accidentally exposed files like /.git/ or /.env.
How to add security headers
You set headers where your site is served: your web server, your CDN, or your framework. A few examples:
- Vercel / Next.js: add them under
headersinvercel.jsonor your framework config. - Nginx:
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always; - Apache: use
Header setin your.htaccessor vhost. - Cloudflare: add them as Transform Rules or via a Worker.
Add CSP last and test it: start in report-only mode so you do not accidentally block your own scripts.
securityheaders.com vs eighty
securityheaders.com is a great quick grader for headers alone. eighty is built for the whole picture: we check your headers, TLS, cookies and exposed files, then combine that with your speed, SEO and AI visibility, and hand you a prioritised, plain-language plan to fix everything. One scan, the full story.
Scan your website free
Get your speed, security, SEO and AI-visibility score in under a minute. No signup.
Run a free scan →