See which security headers a site sends, get a grade, and copy the exact lines to add to your server.
Any page — headers can differ between pages and subdomains.
We request the page as CubDomainBot and read the response headers.
Pick your server or host and copy the lines to add.
Missing Content-Security-Policy or HSTS costs the most; the others less. A is all seven set well, F is almost none. The grade is a guide, not a full security audit.
Most won’t. Content-Security-Policy can, if your pages load scripts or fonts from other sites — test it in report-only mode first.
No. Modern browsers ignore both, so we don’t count them. We only flag them if they’re set in a way that could cause problems.