SecurityHeaders

SecurityHeaders is our editors’ choice free HTTP security-header scanner for 2026. Not because an “A” badge means your SaaS is unhackable, but because securityheaders.com remains the fastest shared language between developers, freelancers, and small-agency ops for “are we shipping the boring response headers that stop the easy classes of browser abuse?” Used as a checklist and teaching aid—not as a penetration-test substitute—it earns a permanent bookmark.

This review is for US and UK webmasters, indie developers, WordPress maintainers, and IT helpers who need to interpret grades honestly: what CSP and HSTS actually buy you, what an F usually means, and why antivirus marketing has nothing to do with this tool.

Quick verdict

SecurityHeaders earns 4.6 / 5 and our editors’ choice badge as the free site scanner for HTTP security headers. Paste your origin on securityheaders.com, read which headers are missing or weak, fix them in your web server / CDN / app framework, then re-scan. Treat an A as “browser hardening basics are present,” not “we passed a security audit.” Pair it with real app testing, TLS hygiene (Let’s Encrypt or your preferred CA), and sane cookie flags. Do not confuse a header grade with malware scanning, firewalling, or proof that your CMS plugins are clean.

STA score context: unmatched clarity and usefulness for everyday web hardening; incomplete coverage of application logic and scan-context quirks keep it under a perfect 5.

What is SecurityHeaders?

SecurityHeaders is a free web service that fetches a URL, inspects the HTTP response security headers, and assigns a letter grade with notes on what is present, missing, or suboptimal. Scott Helme’s project became a de facto industry teaching aid: instead of arguing abstractly about “site hardening,” teams point at the same grade and the same missing Content-Security-Policy line.

Core jobs:

• Grade a public URL’s security-related response headers
• Highlight gaps in CSP, HSTS, X-Frame-Options / frame ancestors, Referrer-Policy, Permissions-Policy, and related controls
• Give developers a repeatable before/after check after config changes
• Provide a shareable artifact for “we fixed headers on staging—look” conversations

What it is not: antivirus, antimalware, a WAF, a vulnerability scanner for SQLi/XSS in your code, a SSL Labs replacement for full TLS cipher analysis, or proof that authenticated pages behave the same as the public homepage the scanner hit. Confusing SecurityHeaders with endpoint protection is how people skip real patching and still feel “secured.”

Core features that matter

1. Letter grades you can act on

The headline UX is the grade. A / A+ usually means the important modern headers are present with sensible values. B–D means partial coverage—common on sites that added HSTS years ago but never finished CSP. F often means almost nothing useful is set, or critical headers are absent on the response the scanner received.

Use grades as a prioritized backlog, not as branding. Publishing “we got an A on SecurityHeaders” in a marketing blog is fine; treating that tweet as your annual pen-test is not.

2. Content-Security-Policy (CSP) literacy

CSP is where most teams struggle—and where SecurityHeaders earns its keep as a teacher. A missing CSP is an easy deduction. A present-but-useless CSP (default-src * with unsafe-inline everywhere) may still look “set” while doing little. Real CSP work means inventorying scripts, styles, fonts, frames, and third-party tags, then tightening directives until marketing pixels stop breaking—or you consciously accept the trade-off.

Hands-on rule: never paste a “strict CSP from a blog” into production on Friday afternoon. Deploy on staging, watch the browser console, use report-only mode when available, then enforce.

3. HSTS and transport expectations

HTTP Strict Transport Security tells browsers to prefer HTTPS for your host for a period of time. SecurityHeaders flags missing or weak HSTS. That matters after you have TLS working everywhere—including apex and www, and any legacy HTTP listeners that still answer. Enabling HSTS while half your assets still load over HTTP is how you create self-inflicted outages.

If you are still “thinking about HTTPS,” fix certificates and redirects first; grade headers second.

4. Clickjacking and embedding controls

Older guidance emphasized X-Frame-Options; modern stacks lean on CSP frame-ancestors. SecurityHeaders helps you notice when a site can still be framed by unexpected origins. For banks, admin panels, and SaaS dashboards, that is real defense-in-depth. For a public marketing brochure that must embed in partners’ iframes, you may need a deliberate exception—document it so the next engineer does not “fix” the partner integration by chasing a grade.

5. Referrer-Policy, Permissions-Policy, and the long tail

These headers reduce data leakage and clamp powerful browser features (camera, geolocation, payment APIs, and so on). They rarely make headlines, but they are exactly the kind of boring hardening SecurityHeaders is good at surfacing. If your grade notes call them out, schedule them with the same seriousness as CSP—smaller blast radius, still worth shipping.

How to interpret grades (without cargo-culting)

Grade signal	Sensible reading
A / A+	Basics present; still test CSP breakage and app vulns separately
B / C	Fix the named gaps; do not stop at “good enough for homepage”
D / F	Treat as unpaid debt—especially HSTS/CSP on sites handling logins
Sudden grade drop after CDN change	Diff response headers at edge vs origin; caching of error pages is a classic gotcha
A on marketing site, F on app subdomain	Scan every hostname users touch, not just the vanity domain

Important: SecurityHeaders grades configuration visible on that response. If a WAF returns a challenge page, if geo-routing serves a different stack, or if you scanned http:// while users live on https://www., your grade may describe the wrong surface. Always scan the canonical HTTPS URL users actually open.

What SecurityHeaders is not (read this twice)

SecurityHeaders will not:

• Detect malware on visitor PCs or on your WordPress uploads folder
• Prove absence of XSS when CSP is absent or when CSP is present but bypassable
• Replace dependency scanning, SAST, DAST, or a human review of auth flows
• Continuously monitor every deploy unless you wire your own CI checks / alerts
• Score business logic flaws, IDOR, or leaked API keys in JavaScript bundles

If you need malware opinions on a file or URL, that is a different class of tool (VirusTotal). If you need phishing page sandboxing, see URLScan.io. SecurityHeaders stays in the HTTP response hygiene lane—and that honesty is why it is editors’ choice for this niche.

Hands-on / lab notes

Task	Result
Scan canonical HTTPS homepage	Fast; clear missing-header list
Scan HTTP then HTTPS	Grades can differ—always prefer the live HTTPS URL
Add HSTS only	Grade improves; CSP debt often remains
Ship report-only CSP then enforce	Correct path; fewer Friday incidents
Scan behind bot challenge	May grade the interstitial, not the app—adjust access or test from allowlisted context
Chase A+ by disabling needed third parties	Marketing breaks; document exceptions instead of silent removals
Re-scan after CDN header sync	Confirms edge config actually shipped

Week-one hardening order that works: confirm TLS and redirects → add HSTS with a modest max-age once HTTPS is solid → set Referrer-Policy and Permissions-Policy → tackle CSP in report-only → tighten CSP → re-scan SecurityHeaders → commit the server/CDN config to version control so the next deploy does not silently drop headers.

SecurityHeaders vs “website security” suite ads

Consumer site-security SKUs often bundle malware cleanup and uptime pings. Useful for some owners—but they do not replace understanding response headers. SecurityHeaders costs nothing and teaches the controls browsers enforce; use it even if you already pay for another SKU.

Pricing and editions

Edition	Cost	Best for
Public URL scan	Free	Developers, agencies, hobby sites
Re-scans after changes	Free	Verify deploys and CDN edits
CI / continuous evidence	DIY (headers in infra-as-code + your monitor)	Teams that need ongoing proof

There is no consumer “SecurityHeaders Premium antivirus.” If a third-party ad implies you must buy a monthly site-protection plan to “use SecurityHeaders properly,” ignore it. Paid needs—WAF, bot management, malware cleanup—are separate purchases with separate success metrics.

Who should use it?

Use SecurityHeaders (editors’ choice) if you:

• Ship or maintain public websites and care about browser-enforced hardening
• Need a shared checklist between developers and whoever controls nginx, Cloudflare, or the app framework
• Want free before/after proof after enabling CSP or HSTS
• Are tired of vague “secure your site” advice without a concrete header backlog

Skip treating SecurityHeaders as complete protection if you:

• Need endpoint antimalware for users’ devices (wrong tool)
• Expect an A grade to replace code review and auth testing
• Cannot test CSP changes safely before enforce mode
• Only scan a vanity domain while apps live on other hostnames

Alternatives to consider

Alternative	Best when
Mozilla Observatory	You want another free header/TLS-oriented opinion alongside SecurityHeaders
SSL Labs Server Test	Deep TLS/cipher and certificate configuration analysis
Browser DevTools / CSP report-only	Live debugging of policy violations during development
Commercial DAST / bug bounty	Finding application vulnerabilities headers cannot fix
VirusTotal / URLScan.io	File/URL malware and phishing analysis—not header grades

See the tools directory for TLS, scanning, and webmaster utilities that complete the stack.

Practical week-one playbook

Day 1: Scan apex, www, and app subdomains over HTTPS; save grade screenshots.
Day 2: Fix redirects so HTTP→HTTPS and hostname canonicalization are correct.
Day 3: Enable HSTS carefully; verify no mixed-content regressions.
Day 4: Add Referrer-Policy and Permissions-Policy; re-scan.
Day 5: Start CSP in report-only; collect violations from real pages.
Weekend: Enforce tightened CSP on staging, then production; re-scan and file results with deploy notes.

Power-user notes

Put security headers in the edge or reverse-proxy config you actually control, and mirror that policy on staging. For SPAs, the HTML shell headers matter as much as API responses. Pair SecurityHeaders screenshots with infra-as-code diffs—auditors want durable controls, not a one-off A from last March.

Final score: 4.6 / 5 (Editors’ Choice)

SecurityHeaders remains the free grading tool we tell webmasters to use in 2026: fast, educational, and honest about measuring HTTP security headers—not magical total website security. An A is worth celebrating; an untested CSP from a gist is not. That clarity earns editors’ choice.

FAQ

Is SecurityHeaders free?
Yes. The public scanner at securityheaders.com is free for normal site checks.

Is SecurityHeaders an antivirus?
No. It grades HTTP security headers on a URL you submit. It does not scan disks, email attachments, or visitor devices for malware.

What does an F grade mean?
Usually that important security headers are missing or ineffective on the response the scanner received. Fix the listed gaps, then re-scan the canonical HTTPS URL.

Will an A grade stop XSS?
Not by itself. A strong CSP helps reduce XSS impact and some injection paths, but application bugs can still exist. Headers are defense-in-depth, not a full app audit.

Why did my grade change after a CDN migration?
Edge configs often drop or override origin headers. Diff responses with curl -I (or your CDN dashboard) and align header policy at the edge.

Should I copy a strict CSP from a tutorial?
Only after testing. Prefer report-only, watch console violations, then enforce. Blind strict CSP ships breakages.

SecurityHeaders vs SSL Labs?
SecurityHeaders focuses on security response headers. SSL Labs focuses on TLS/certificate configuration. Use both for public sites.