# Security Header Grader

> Analyze HTTP security headers on any page - grade, explain misconfigurations, detect tech stack leaks, and get exact fixes. Built for pentesters and developers.

Canonical page: [https://chrome-stats.com/d/security-header-grader](https://chrome-stats.com/d/security-header-grader)

## Overview

- **ID:** `security-header-grader`
- **Platform:** Firefox
- **Type:** Firefox add-on
- **Status:** Available
- **Publisher:** Abinesh Kamal K U
- **Category:** web-development,privacy-security
- **Daily users:** 2
- **Weekly downloads:** 1
- **Version:** 1.0.1
- **Last updated:** 2026-06-09
- **First published:** 2026-06-06
- **Size:** 58 KB
- **Data as of:** 2026-09-06
- **Store listing:** [Firefox Add-ons Store](https://addons.mozilla.org/firefox/addon/security-header-grader/)

## Description

Security Header Grader analyses the HTTP response headers of any website you visit and gives you an instant security grade (A–F), per-header scores, and actionable fix recommendations — all inside a clean popup.

<strong>What it checks (28 headers):</strong>
- Transport: Strict-Transport-Security (HSTS)
- Injection / XSS: Content-Security-Policy, X-XSS-Protection
- Clickjacking: X-Frame-Options
- MIME: X-Content-Type-Options, Content-Type
- Privacy: Referrer-Policy, Permissions-Policy, X-DNS-Prefetch-Control
- Cross-Origin Isolation: COOP, COEP, CORP
- CORS: Access-Control-Allow-Origin, Access-Control-Allow-Credentials
- Cookies: Set-Cookie flags (Secure, HttpOnly, SameSite)
- Caching: Cache-Control
- Info leaks: Server, X-Powered-By, X-AspNet-Version, X-Runtime, Via, X-Varnish, and more

<strong>Tech Stack Detection:</strong>
Identifies 34 server, framework, and CMS signatures (Apache, Nginx, IIS, PHP, WordPress, Drupal, Express, Rails, and more) with risk ratings and direct links to CVE advisories.

<strong>Key features:</strong>
- Overall grade A–F with animated score ring
- Filter headers by category, missing, or issues
- Per-header score bar with detailed analysis and one-click fix copy
- Tech Stack tab showing info-leak findings with risk levels
- OWASP and MDN documentation links per header
- 100% local — no data ever leaves your browser, zero telemetry

Built for penetration testers, security researchers, and web developers.

## Rankings

- #70,348 — Overall
- #67 — security
- #78 — upgrade
- #156 — header
- #221 — secure

## Permissions and access

### Permissions

- `activeTab`
- `webRequest`
- `storage`
- `tabs`
- `<all_urls>`

## Safety

- **Risk impact:** High risk impact
- **Risk likelihood:** High risk likelihood

### Analysis details

- Grants access to browser tabs, which can be used to track user browsing habits and history, presenting a privacy concern.
- This extension has low user count. Unpopular extensions may not be stable or safe.

> Some risk analysis details are omitted from this free response. [Upgrade to view the full analysis](https://chrome-stats.com/pricing).

## Similar extensions and apps

- [HTTP Header Security Auditor](https://chrome-stats.com/d/http-header-security-auditor) — 2 users
- [OWASP Secure Headers Checker](https://chrome-stats.com/d/owasp-secure-headers-checker) — 8 users
- [cSPY - SecurityHeader Scanner](https://chrome-stats.com/d/vaultocean-header-scanner) — 36 users, 5.00 / 5
- [I Hate Security Headers!](https://chrome-stats.com/d/i-hate-security-headers) — 2 users
- [Dev Headers](https://chrome-stats.com/d/dev-headers) — 1 users
- [OWASP Secure Headers](https://chrome-stats.com/d/owasp-secure-headers) — 9 users
- [cSPY - SecurityHeader Scanner](https://chrome-stats.com/d/cspy) — 36 users, 5.00 / 5
- [QuickAudit — web security checklist](https://chrome-stats.com/d/quickaudit-web-security) — 1 users
- [SecureGuard - Web Security Scan](https://chrome-stats.com/d/secureguard-web-security-scan) — 1 users
- [NetForge — Security Analyzer](https://chrome-stats.com/d/netforge-security-analyzer) — 2 users
- [Website Security Scanner](https://chrome-stats.com/d/website-security-scanner) — 3 users
- [Security Headers Checker](https://chrome-stats.com/d/security-headers-checker) — 3 users

---

Source: [Chrome-Stats](https://chrome-stats.com/d/security-header-grader)