---
title: "Free security headers checker: grade your site A+ to F · MetricDeck"
description: "Check a website's security headers (HSTS, CSP, X-Frame-Options and more), get a grade from A+ to F, and copy the fix for Nginx, Apache, Next.js or Vercel."
url: https://metricdeck.app/tools/security-headers
updated: 2026-10-06
---

Free tool · no sign-up

# Check your website's security headers

Get a grade from A+ to F for the six headers that protect your visitors, and copy the fix for Nginx, Apache, Next.js, Vercel, Netlify or Cloudflare.

What it checks

## Six headers, 100 points

Each one that's missing or weak comes with the value to send instead.

* ### Strict-Transport-Security
25 points
Tells browsers to use HTTPS for the site from now on, so nobody on the same Wi-Fi can push a visitor onto an insecure version.
Suggested: `max-age=63072000; includeSubDomains`
* ### Content-Security-Policy
25 points
Says where scripts, styles, frames and forms may come from, which stops most injected code from running.
Suggested: `frame-ancestors 'self'; base-uri 'self'; object-src 'none'`
* ### X-Frame-Options
15 points
Stops other sites showing yours in a frame to trick visitors into clicking (clickjacking). CSP's frame-ancestors does the same.
Suggested: `SAMEORIGIN`
* ### X-Content-Type-Options
15 points
Stops browsers guessing a file's type, so an upload can't be run as a script.
Suggested: `nosniff`
* ### Referrer-Policy
10 points
Decides how much of the page's address other sites see when a visitor follows a link, so private paths and query strings stay private.
Suggested: `strict-origin-when-cross-origin`
* ### Permissions-Policy
10 points
Switches off browser features the site doesn't use (camera, microphone, location), for the site and anything it embeds.
Suggested: `camera=(), microphone=(), geolocation=(), browsing-topics=()`

The grade

## From A+ to F

The points decide the grade. It also flags what the six headers don't cover: a server that gives away its version, cookies sent without Secure or SameSite, and an http:// address that doesn't move visitors to https://.

| Grade | Score                                   |
| ----- | --------------------------------------- |
| A+    | 95–100, every header right, no warnings |
| A     | 85–94                                   |
| B     | 70–84                                   |
| C     | 55–69                                   |
| D     | 40–54                                   |
| E     | 25–39                                   |
| F     | 0–24                                    |

FAQ

## Questions

What are security headers?

Short instructions your server sends with every page, telling the browser how to protect visitors: use HTTPS only, don't let other sites frame the page, don't guess file types, keep addresses private, and switch off features the site doesn't use. They cost nothing to add and take a few lines of configuration.

Will adding them break my site?

Five of the six almost never do. Content-Security-Policy can, because it limits where scripts may come from. The policy this checker suggests is a safe start that only controls framing, base tags and plugins. To go further, send your policy as Content-Security-Policy-Report-Only first and watch what it would block.

How is the grade worked out?

Six headers share 100 points: Strict-Transport-Security 25, Content-Security-Policy 25, X-Frame-Options 15, X-Content-Type-Options 15, Referrer-Policy 10, Permissions-Policy 10\. A header that's there but weak gets part of its points. A+ needs 95 or more with every header right and no warnings, and a page that isn't served over HTTPS gets an F whatever it sends.

Do security headers help SEO?

Not directly: Google doesn't rank pages by them, though it does prefer HTTPS. They protect your visitors and your clients' trust, and security reviews, agencies' audits and larger clients often ask for them.

What do you keep when I run a check?

A record of the check, kept 12 months so we can see how the tool is used: the address, the result, when, your country, browser and device type, and the site that sent you. Never your IP address; a scrambled form of it is kept for 2 days, only to limit how often the checker can be run.

Is it free?

Yes, with no sign-up. MetricDeck itself watches every client's site every day (uptime, SSL, domain expiry, speed and AI search readiness), and its free plan covers one site.

## Every client's site, watched every day

MetricDeck checks uptime, SSL, domain expiry, speed and AI search readiness on every site you look after, beside Search Console, Analytics and Google Ads, and tells you which client needs you today.

[Start free](https://metricdeck.app/signup) [See the live demo](https://metricdeck.app/demo)

Free for one client · No card · Read-only access