What security headers do
Headers are instructions your server sends with every page. HSTS keeps visitors on HTTPS, a Content-Security-Policy limits which scripts can run, X-Frame-Options stops other sites framing your pages, and Referrer-Policy limits what is shared with the sites visitors go on to.
They cost nothing, work on any website and block whole classes of attack.
How the grade works
Each header is checked for presence and for common weaknesses, such as a Content-Security-Policy that allows unsafe-inline scripts. Failures cost more points than warnings. The result also lists version details your server gives away and cookies missing protective flags.
Frequently asked questions
Where do I add security headers?
In your web server or CDN settings. The checker gives ready-made snippets for Apache and Nginx. Many hosting panels and CDNs also have a simple switch for them.
Can a Content-Security-Policy break my site?
Yes, if it blocks scripts or styles you use. Add it in report-only mode first, or test on a staging copy.
Is an A grade enough to be secure?
No. Headers are one layer. You still need updates, strong passwords, backups and monitoring.
Read-only: we request public pages the way a visitor would. Private and internal addresses are blocked, and nothing you enter is stored.
Want this running on every page, every day?
UrKavach monitors security, uptime, speed and SEO for every website you manage.