formexposed
Get started

Security headers

How well does your site protect what visitors type in?

A grade from A+ to F for the HTTP headers of your start page: HTTPS and HSTS, Content Security Policy, protection against framing, cookies and what the server gives away. Free, no account, two requests.

We load your start page twice (https and http), nothing else. Domains that opted out are not checked.

What we check

Start: 100 points. Missing protection costs points, extra protection adds a few. The grade follows the points: A+ from 100 (with HTTPS, HSTS and a strict CSP), A from 90, B from 75, C from 60, D from 45, below that F.

  • HTTPS: the page and form entries travel encrypted (-40 without).
  • HSTS: browsers never fall back to unencrypted http, even on a typed address (-20 without, -10 under 6 months, +5 with preload).
  • Content Security Policy: only approved scripts run - an injected script cannot read the form (-25 without, -15 report-only, -10 with unsafe-inline/eval).
  • Framing: no foreign page can show yours in a frame and catch clicks (-20 without X-Frame-Options or frame-ancestors).
  • nosniff: the browser does not guess file types (-5 without).
  • Referrer-Policy: addresses with form parameters do not leak to other sites (-5 if unsafe).
  • Cookies: Secure, HttpOnly and SameSite (up to -20).
  • Server and X-Powered-By without versions - attackers look for exactly those (-5).

Similar to Mozilla HTTP Observatory and securityheaders.com; our weighting puts what protects form entries first. A good grade does not mean a protected form - that is what the form check is for.