Security Headers Checker — Grade Website Headers

Check and grade the HTTP security headers of any website in bulk with the Security Headers Checker. Paste a list of sites and get each one's grade, the value of every key security header, and a list of what's missing — exported as JSON, CSV or Excel.

Built for security audits, SEO and site-quality reviews, compliance checks and monitoring, it turns a list of URLs into a clear security-header scorecard.

What it does

• 🛡️ Grades each site — an A+ to F grade based on the key security headers present.
• 🔎 Per-header detail — HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy values.
• ❌ Missing list — exactly which recommended headers are absent.
• 🔐 Extras — HTTPS status, server banner, Secure cookie flag, legacy X-XSS-Protection and X-Powered-By.
• ⚡ Bulk & fast — check many sites in parallel with a per-site timeout.
• 📤 Export anywhere — JSON, CSV or Excel, or straight into a dashboard or report.

Example output

{
  "url": "https://github.com",
  "status": 200,
  "grade": "A",
  "score": 5,
  "https": true,
  "hsts": "max-age=31536000; includeSubdomains; preload",
  "contentSecurityPolicy": "default-src 'none'; ...",
  "xFrameOptions": "deny",
  "missing": ["permissions-policy"]
}

How to use it

1. Paste a list of website URLs (or bare domains).
2. Tune concurrency and the per-site timeout if needed.
3. Run, and download the scorecard as JSON, CSV or Excel.

Input fields

Field	Description
Website URLs	Full URLs or bare domains (checked over HTTPS).
Concurrency	Sites to check at once (1–20).
Per-site timeout (seconds)	How long to wait before marking a timeout.
Max sites	Maximum sites to check (0 = no limit).

Output fields

url, ok, status, finalUrl, server, https, grade, score, missing, hsts, contentSecurityPolicy, xFrameOptions, xContentTypeOptions, referrerPolicy, permissionsPolicy, xXssProtection, setCookieSecure, poweredBy.

Popular use cases

• Security audits — score a portfolio of sites and flag weak configurations.
• SEO & site quality — headers are part of a healthy, trustworthy site.
• Compliance — evidence which security headers are (or aren't) in place.
• Monitoring — schedule runs and catch regressions when headers change.
• Agencies — produce client-ready security-header reports at scale.

FAQ

Do I need an account or key? No. Paste your URLs and run.

How is the grade calculated? From the presence of six recommended security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) — more present means a higher grade.

Can I check bare domains? Yes — bare domains are checked over HTTPS automatically.

Can I export to Excel or Google Sheets? Yes — results download as JSON, CSV or Excel and integrate with Sheets, dashboards and reports.

---

Bulk website security-header grading — HSTS, CSP, X-Frame-Options and more — clean and export-ready for security and SEO audits.