Check a page
The page is fetched once from Cloudflare's edge with a browser user-agent. Redirects are followed up to five hops. Ten checks a minute per IP.
How it works
Fetch
The URL is requested once from Cloudflare's edge with a normal browser user-agent, following up to five redirects. Nothing runs in your browser except the rendering.
Read
Every response header is captured, plus Set-Cookie flags, a meta CSP if one is used, and whether the HTML references http:// resources.
Grade
Each header is scored by what it actually does — an HSTS with a ten-minute max-age is not an HSTS — and version disclosure and mixed content deduct.
Fix
Missing or weak headers are turned into a block you can paste into Cloudflare, Nginx or Apache, and copy in one click.
Why a cold email site cares about security headers
Every link in an outbound sequence gets fetched by something that is not the prospect first: Gmail's link scanner, Microsoft Defender SafeLinks, Proofpoint URL Defense, Slack's unfurler. Those scanners score the destination, and a landing page with no HSTS, no framing protection and a leaking server header scores like a page that was set up in an afternoon — which, for a lot of tracking and landing domains, it was. The headers on this page are the cheapest reputation signal there is, because they cost nothing and take one rule on Cloudflare.
The four that matter most
HSTS tells browsers to never try plain HTTP for this host again, which closes the downgrade window on every click; with a year's max-age and the preload flag, Chrome ships the rule in the browser itself. Content-Security-Policy is the one that actually stops cross-site scripting, and the one most sites get wrong: a policy with 'unsafe-inline' in script-src is decorative. X-Frame-Options or frame-ancestors stops the page being loaded invisibly inside someone else's, which is how clickjacking works. Cookie flags — Secure, HttpOnly, SameSite — decide whether a session can be stolen by a script or ridden by another site.
The grade is about what the headers do
A lot of header checkers give full marks for presence. This one reads the values. HSTS with a max-age under six months scores as weak; a CSP that allows inline scripts scores as weak; a Referrer-Policy of unsafe-url is worse than none. COOP and CORP are worth a few points because they matter for a few specific attacks, not because everyone needs them. Version disclosure and mixed content deduct, because the first hands an attacker a CVE list and the second gets the page flagged by browsers before any scanner sees it.
How to fix it in five minutes
On Cloudflare, go to Rules → Transform Rules → Modify Response Header and add the headers from the block at the bottom of the results as static values on every request. That covers everything except cookies, which are set by the application. For CSP, start with Content-Security-Policy-Report-Only, watch the console for a day, then switch to enforcing. On Nginx it is add_header in the server block; on Apache, Header always set. Re-run the check after purging the cache.
Frequently asked questions
What grade should I aim for?
A on anything a prospect or scanner will hit: landing pages, tracking domains, the domain in your signature. A+ needs a strict CSP and HSTS preload, which is worth it for the main site and unnecessary for a redirect domain.
Why is my CSP marked weak when it is present?
Because it allows 'unsafe-inline' or 'unsafe-eval' in script-src, or uses a wildcard source. A policy that lets any inline script run does not stop the attack CSP exists to stop. Use nonces or hashes for the inline scripts you need.
Does the check run from my browser?
No. Browsers cannot read another site's response headers. The fetch runs from Cloudflare's edge and the result is sent back to the page. Ten checks a minute, a hundred a day, per IP.
Will adding these headers break my site?
HSTS, nosniff, X-Frame-Options, Referrer-Policy and Permissions-Policy almost never do. CSP can, if it blocks a script you rely on — which is why you deploy it as report-only first.
What is HSTS preload?
A list shipped inside Chrome, Firefox and Safari of hosts that must only be loaded over HTTPS, so even the very first visit is protected. You submit at hstspreload.org once the header has max-age of a year, includeSubDomains and preload.
Last reviewed
What to run next
The checks that most often follow this one.
More in this category
Guides that go deeper
When the tools tell you something is wrong
The diagnostics here are free and always will be. When the fix is bigger than a DNS record, this is the work I do.
Deliverability rescue
Mail landing in spam, replies gone quiet, or a domain suddenly blocked. I find the actual cause rather than guessing, and fix it.
- Authentication and alignment failures
- Blocklist delistings and reputation repair
- Gateway and filter-level blocks
- A written report on what broke and why
Email & sending infrastructure
Sending domains, inboxes, authentication and warmup, built to survive volume instead of burning down in a month.
- Domain and inbox fleets at any scale
- SPF, DKIM, DMARC and tracking domains
- Google Workspace — Silver Partner
- Handover documentation you actually own
Domain, DNS & migration
Changing registrar, mail provider or host without a day of downtime or a week of mail silently failing.
- Registrar and nameserver moves
- Workspace and Microsoft 365 migrations
- MX, SSL and subdomain cutover
- Staged rollout with rollback at every step
Monitoring & retainer
Infrastructure drifts. Records get edited, certificates expire, domains get listed. Ongoing eyes on the fleet.
- Scheduled checks across every domain
- Alerts before your clients notice
- Monthly reporting
- Priority response when something breaks
Start with a call
Bring a domain and the symptom. I will tell you what is actually wrong and whether you need me at all — plenty of people leave that call able to fix it themselves.
Thirty minutes, no pitch
We will run the checks together on your actual domains, and you will leave knowing what is broken, what it takes to fix, and what it should cost. If that is a job you can do in-house, I will say so.