Paste your site's HTTP response headers and get an A–F grade with the exact headers to add. Missing headers are how AI-built apps end up open to XSS, clickjacking, and protocol downgrade attacks.
Get your headers with curl -I https://yourapp.com or your browser's DevTools → Network → click the document → Response Headers. Load an example →
Standards reference: Security headers are documented in the OWASP Secure Headers Project. Missing Content-Security-Policy is the primary enabler of Cross-Site Scripting (CWE-79, OWASP Top 10 A03). HSTS is mandated by NIST SP 800-52 Rev.2. Google's 2024 HTTPS Transparency Report found 95% of top-1000 sites deploy HSTS.
The other 85% — exposed keys, open databases, broken auth, N+1 queries, no monitoring — needs a real scan. Get your full Launch Readiness Score in ~60 seconds.
Get my free scoreHTTP security headers are response headers your server sends with every page load, instructing the browser how to handle your content. They are one of the fastest and most impactful security improvements you can make to any web app — most can be added in under 10 minutes with no code changes, just server configuration.
The six headers graded here are: Content-Security-Policy (CSP), which restricts where scripts and resources can load from, blocking XSS attacks; Strict-Transport-Security (HSTS), which forces HTTPS connections and prevents protocol downgrade attacks; X-Frame-Options (or CSP frame-ancestors), which prevents your pages from being embedded in iframes on other domains; X-Content-Type-Options, which stops browsers from guessing MIME types and executing content as a script; Referrer-Policy, which controls how much URL information is passed to third parties; and Permissions-Policy, which restricts browser features like camera, microphone, and geolocation access.
Apps deployed to Render, Railway, Vercel, or Netlify without custom header configuration often return no security headers at all. The platform serves your content with default settings, which prioritize compatibility over security. OWASP A05:2021 (Security Misconfiguration) lists missing security headers as one of the top causes of vulnerabilities in web applications.
Content-Security-Policy is the hardest to configure correctly because it requires knowing every external resource your app loads. A common mistake is setting CSP to unsafe-inline or unsafe-eval to stop console errors, which removes most of the protection. The correct approach is to identify all legitimate resource origins and list them explicitly, then use nonces or hashes for inline scripts if needed.
On Express.js (Node), use the Helmet middleware, which sets all major security headers with sensible defaults in a single line. On Vercel, add a headers array to vercel.json. On Render, use the Custom Headers section in your service settings. On Netlify, add a _headers file to your publish directory. For nginx or Apache deployments, add header directives to your server block or virtual host configuration.