Security Headers

Security headers checker with letter grade, severity levels, batch scan, site compare, fix snippets, and shareable report card.

Inspect HTTP security headers on any site and get an instant letter grade. Security Headers scans any webpage's HTTP response headers and grades them A+ through F based on security best practices. See which headers are present, missing, or misconfigured — all in one click. How it works: 1. Click the extension icon on any page. 2. Hit "Scan This Page" to analyze security headers. 3. See your letter grade (A+ to F) with color coding. 4. Review each header with pass/fail status and recommendations. Headers checked: - Content-Security-Policy (CSP) - Strict-Transport-Security (HSTS) - X-Content-Type-Options - X-Frame-Options - X-XSS-Protection (flagged as deprecated) - Referrer-Policy - Permissions-Policy - Cross-Origin-Opener-Policy (COOP) - Cross-Origin-Resource-Policy (CORP) - Cross-Origin-Embedder-Policy (COEP) Features: - Letter grade — instant A+ to F rating based on weighted header analysis. - Color-coded results — green (present and good), yellow (present but weak), red (missing). - Header explanations — each header includes what it does and why it matters. - Recommendations — specific guidance on how to fix missing or weak headers. - Scan history — see grades for recently visited sites stored locally. - Copy report — one-click formatted security report for sharing with your team. - Collapsible sections — expand only the headers you need to investigate. - 100% local — no data leaves your browser. No accounts, no tracking, no servers. Who is this for? - Web developers verifying security headers before deployment. - Security engineers auditing websites for compliance. - DevOps teams checking header configurations. - Anyone curious about a website's security posture. Privacy: Security Headers does not collect, transmit, or share any data. Scan history is stored locally using Chrome's built-in storage. No analytics, no telemetry, no third-party services.