Security headers check
Grade the HTTP security headers of any site from A+ to F, with what each header does and what to change.
What this tool checks
DNSPeek loads your domain from https:// (or http:// when nothing answers over HTTPS), follows its redirects like a browser and reads the response headers of the final page. Behind a CDN such as Cloudflare these are the headers its edge sends. It checks Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, and notes Server or X-Powered-By headers that reveal software versions.
What the headers protect against
HSTS keeps browsers on HTTPS so nobody can downgrade the connection. A CSP limits where scripts may load from, the main defence against cross-site scripting. X-Frame-Options stops other sites from framing yours for clickjacking. nosniff stops browsers from running a file as a different type than declared. Referrer-Policy limits what URLs leak to other sites, and Permissions-Policy switches off browser features you do not use.
After a migration
Headers are set by the web server or the CMS, so they often change when a site moves. Compare the grade before and after the switch. What previews change, and why, is on the limitations page.
Frequently asked questions
How is the grade calculated?
Six headers earn points: Strict-Transport-Security 25, Content-Security-Policy 25, X-Frame-Options (or CSP frame-ancestors) 15, X-Content-Type-Options 15, Referrer-Policy 10 and Permissions-Policy 10. A weak value earns half. 95 or more is A+ when no software versions are disclosed, 85 is A, 70 is B, 55 is C, 40 is D and anything lower is F. A page that does not load normally (a redirect loop, a connection failure, an error page or a bot-protection challenge) is not graded: the tool shows why instead.
Which header should I add first?
Strict-Transport-Security and X-Content-Type-Options: nosniff are one line each and safe on almost every site. A Content-Security-Policy gives the most protection but needs testing, so start with Content-Security-Policy-Report-Only and tighten it once no violations are reported.
Why is my grade lower than on another scanner?
Scanners weigh headers differently and some check more of them. This tool checks the headers of the page your domain finally lands on after redirects, as a visitor would see it.
Do DNSPeek preview links keep my security headers?
No. To make pages work on the preview address, DNSPeek removes Strict-Transport-Security, Content-Security-Policy and X-Frame-Options in previews. Check your headers on the real domain after the DNS switch, with this tool.
Moving a site to a new server?
See the site on the new server before you change DNS: DNSPeek gives you one HTTPS preview link that works on any device and that you can share with your team or client. No hosts file, no VPN.
Create a free preview link