HTTP Security Headers Checker
Check the security headers on any URL, including CSP, HSTS, X-Frame-Options and Referrer-Policy. Get an A+ to F grade with the recommended value for each header.
What is an HTTP security headers check?
An HTTP security headers check fetches a public URL and evaluates whether browser-enforced response headers are present and correctly configured. Strong headers reduce XSS, clickjacking, MIME sniffing, and insecure transport risks. Vigilbase grades the result A through F and explains what to fix.
Agents can run the same non-intrusive scan via POST /api/v1/agent/tools/security-headers/execute.
What this security headers test checks
The check requests your URL, reads the response headers and scores ten of them. Each is scored out of 10 against its recommended value, then weighted by how much protection it adds.
Content-Security-Policy
Weight: 20/100
Limits where scripts, styles, frames and other resources can load from, which reduces the impact of cross-site scripting (XSS).
Recommended: default-src 'self'; frame-ancestors 'none'
Loses points for 'unsafe-eval', 'unsafe-inline', a bare * wildcard, data: in script sources, and a missing default-src or frame-ancestors directive.
Strict-Transport-Security
Weight: 20/100
Tells browsers to use only HTTPS for the domain, which blocks protocol downgrades and cookie exposure over plain HTTP.
Recommended: max-age=31536000; includeSubDomains; preload
Loses points for a max-age under one year (more under one day) and for missing includeSubDomains or preload.
X-Frame-Options
Weight: 10/100
Stops other sites from framing your pages, the basis of clickjacking attacks.
Recommended: DENY
SAMEORIGIN earns nearly full credit. The deprecated ALLOW-FROM and invalid values score lower.
X-Content-Type-Options
Weight: 10/100
Stops browsers from guessing (sniffing) a response's content type and running it as script.
Recommended: nosniff
Any value other than nosniff scores low.
Referrer-Policy
Weight: 10/100
Controls how much of the page URL is sent to other sites in the Referer header.
Recommended: strict-origin-when-cross-origin
no-referrer earns full credit; same-origin and strict-origin score well. unsafe-url and no-referrer-when-downgrade score lower because they can leak full URLs.
Permissions-Policy
Weight: 10/100
Turns off browser features such as camera, microphone and geolocation for pages that do not need them.
Recommended: camera=(), microphone=(), geolocation=()
A present policy earns most of the credit. Allowing camera, microphone or geolocation for every origin costs points.
Cross-Origin-Opener-Policy
Weight: 5/100
Separates your page from cross-origin windows it opens or is opened by.
Recommended: same-origin
same-origin-allow-popups earns partial credit; unsafe-none scores low.
Cross-Origin-Embedder-Policy
Weight: 5/100
Requires cross-origin resources to opt in before the page loads them. With COOP, it enables cross-origin isolation.
Recommended: require-corp
credentialless earns partial credit; unsafe-none scores low.
Cross-Origin-Resource-Policy
Weight: 5/100
Stops other sites from loading your resources, such as images and scripts, into their pages.
Recommended: same-origin
same-site earns nearly full credit; cross-origin scores half.
X-XSS-Protection
Weight: 5/100
Controlled the legacy XSS filter in older browsers. It is deprecated; Content-Security-Policy replaces it.
Recommended: 0
Keeps partial credit whether it is absent, set to 0 or set to 1; mode=block, so it moves the total by at most 1.5 points.
How the A+ to F grade works
The weighted header scores add up to a total out of 100. A missing header scores zero for its share, except X-XSS-Protection. If the URL returns an error status or a bot verification challenge, the result is reported as unable to assess, without a grade.
- A+
- 90-100
- A
- 80-89
- B
- 65-79
- C
- 50-64
- D
- 35-49
- F
- 0-34
A high grade means the headers match this baseline at scan time. It does not test application code, authentication or the rest of the site, and a policy should fit the features your pages use before you enforce it. OWASP Secure Headers Project
Questions
Security headers checker FAQ
What does the Vigilbase HTTP Security Headers Checker do?
It fetches a public URL, inspects response headers against the OWASP Secure Headers Project expectations, and returns an A-F grade with per-header findings and remediation guidance.The result describes the responses available at scan time. A header grade does not test authenticated application behavior or prove that the site is free of vulnerabilities.A practical website protection guideWebsite Security Check
Which headers are checked?
The scan covers Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, and Cross-Origin isolation headers such as COOP, COEP, and CORP.Headers should fit the application and browser features it uses. Validate proposed CSP, framing and cross-origin policies with representative user journeys before enforcing them.A practical website protection guideManaged WAF operations and change control
How is the security headers grade calculated?
Each of the ten headers is scored out of 10 against its recommended value, then weighted: Content-Security-Policy and Strict-Transport-Security count for 20 points each, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy for 10 each, and COOP, COEP, CORP and X-XSS-Protection for 5 each. The total out of 100 maps to A+ (90 or more), A (80), B (65), C (50), D (35) or F.A missing header scores zero for its share, except the deprecated X-XSS-Protection, which keeps partial credit. Error responses and bot verification challenges are reported as unable to assess, without a grade.A practical website protection guideWebsite Security Check
What are the recommended security header values?
A strong baseline is Strict-Transport-Security: max-age=31536000; includeSubDomains; preload, X-Content-Type-Options: nosniff, X-Frame-Options: DENY or SAMEORIGIN, Referrer-Policy: strict-origin-when-cross-origin, a Permissions-Policy that disables unused features, and a Content-Security-Policy with default-src and frame-ancestors that avoids 'unsafe-inline' and 'unsafe-eval'.Recommended values are a starting point, not a copy-paste policy. Only enable HSTS preload once every subdomain serves HTTPS, and test cross-origin isolation headers against embedded content before enforcing them.A practical website protection guideManaged WAF operations and change control
Can agents run this scan autonomously?
Yes. Agents can POST {"target":"https://example.com"} to https://vigilbase.com/api/v1/agent/tools/security-headers/execute without Turnstile (optional developer API key from https://one.vigilbase.com/developers). See https://vigilbase.com/developers. The browser UI remains available for interactive use.Use the documented API contract and respect rate limits. This endpoint analyzes public headers; it does not authorize intrusive testing or change the target configuration.Run a check through the public APIAPI authentication and rate limits
Is the Security Headers Checker free?
Yes. The public tool and agent API are free for non-intrusive header analysis. No Vigilbase account is required.The initial header analysis does not require a Vigilbase account. Optional reports and other tools can have separate email or authorization requirements.Compare the public security checksTool access and verification requirements
