DarnlySecurity headers checker: is my site’s security set up right?
Paste your site and get a grade from A to F for the security headers it sends, with a ready file for your host and one prompt for your AI agent.
Free from Darnly. Spot a bug in the app you're building? Darnly hands it to Claude Code, Codex or Cursor in one key.Add to Chrome
Example result for a typical new app. Paste your site above to check yours.
Fix it on
All response headers
More free tools
See all 89 tools- API key leak checkerDid I leak an API key? Check your site’s JavaScript for OpenAI, Stripe, Supabase and other secret keys.
- JWT decoderPaste a token and see when it expires, who it’s for and its role, in plain words. Nothing is uploaded.
- EXIF removerSee if your photos show where you live, then remove the location, date and camera info in one click.
How it works
- Paste your site’s address. Below is an example of a typical new app, so you can see what you’ll get.
- We load the page from the internet and read the security headers your host sends back with it, plus the flags on any cookies it sets.
- You get a grade from A to F and a card for each header. Pick your host to get a ready file to paste, or copy one prompt for Claude Code, Cursor or Codex.
Questions
What are security headers?
Short instructions your server sends with every page, telling the browser how careful to be: only use https, don’t run scripts from unknown places, don’t let other sites frame this page, and so on. They cost nothing, and most new apps ship without them.
What does the grade mean?
Each header is worth points: the Content Security Policy and https (HSTS) count most, then framing, file-type guessing, referrer, cookies, permissions and the server version. A good header earns all its points, a weak one half, a missing one none. 90 or more is an A, 75 a B, 60 a C, 40 a D, and below that an F.
Will adding a Content Security Policy break my site?
It can, because it blocks any script, font or API it doesn’t list. That’s why the starter policy is built from what your page actually loads. Add it on a preview deploy first, click around, and look for “Content Security Policy” errors in the browser console. Your AI agent can add any services it missed.
Where do the snippets go?
Vercel reads a vercel.json file at the root of your project. Netlify and Cloudflare Pages read a file called _headers in the folder that gets deployed (often public/). Next.js can set them in next.config.js. If you’re not sure, copy the prompt and let your agent put them in the right place.
Why does my site score lower than on another checker?
Checkers weigh things a little differently. We focus on what matters for a typical vibe-coded app: https, scripts, framing and cookies first.
Can I check a site on localhost?
No. We check from the internet, so the site needs a public address. Deploy a preview and paste that.