Check your security headers
Grades the HTTP security headers a page sends, the way securityheaders.com does, and tells you exactly which line to add. HSTS, Content-Security-Policy, framing, MIME sniffing, referrer and permissions policies, cookie flags and version leaks. One request, no login.
Any public page. Try .
What to do about it
The check found it. These are the ways to fix it, keep it fixed, or run the same check for every business you serve.
TagFrog Pro
Server-side tracking, consent and every ad platform API, proven with a real test order and kept current. Watch included when it launches.
See TagFrog ProWatch
Re-runs this check every week and emails you the moment the answer changes: site down, tag gone, score dropped, certificate expiring.
Join the waitlistWebsite
No website yet? $499, live in two days, or rebuild a tired one for the same price. Hosting and TagFrog on from day one, Watch when it launches, changes by chat, never a call. Have an agency? They can resell this.
Get online, $499OpsBlu
This same check, run for every local business in a territory. Leads with a reason to call, as CSV, API and MCP.
Go to opsblu.comWhat we check
- Strict-Transport-Security with a usable max-age and includeSubDomains
- Content-Security-Policy present, enforced, without unsafe-inline or wildcards
- X-Frame-Options or CSP frame-ancestors (clickjacking)
- X-Content-Type-Options: nosniff
- Referrer-Policy and Permissions-Policy
- Cross-Origin-Opener-Policy
- Set-Cookie flags: Secure, HttpOnly, SameSite
- Server / X-Powered-By version leaks
Cost of one run: 1 request. Results for the same URL are kept for a few minutes, so running twice is free and instant.
Questions
What grade should my site get?
A or A+ means HSTS, a real Content-Security-Policy, framing protection, nosniff, a referrer policy and a permissions policy are all present. Most sites start at D or F because nothing is set; each header is one line in your server or CDN config.
Does a missing header mean my site is hacked?
No. These headers are defences the browser applies for you. Missing ones mean an attacker who finds another hole (an injected script, a framed login page) has an easier time. Adding them costs nothing and breaks nothing when done in order.
Why does the check say my CSP is weak when I have one?
A policy that allows 'unsafe-inline' or a wildcard script source lets injected scripts run, which is the thing a CSP exists to stop. Move inline scripts to nonces or hashes and list the exact origins that may run code.