Terms of Use

What You Agree to When You Use This Tool

By using the checker and the generator you accept these terms. They exist because even a small free tool needs its expectations written down.

A grade is not a security audit

The report grades the headers of one response from its own server at one moment. A server may answer differently to other visitors, and a strong set of headers says nothing about the application behind them. An A+ is not a statement that a site is secure, and an F is not a statement that it has been breached. Generated headers are a starting point: a Content-Security-Policy that omits a host your pages use will block that resource, and an HSTS header on a site with an HTTP-only subdomain will lock visitors out of it; test in report-only mode and with a short max-age first, as the pages explain. The tools are provided as is, with no warranty of any kind, and their operator isn't liable for losses that follow from using them.

Your responsibilities

Use the tool lawfully. Check pages you are allowed to inspect; a public page is public, but the responsibility for what you do with the findings stays with you. Don't abuse, overload or automate the fetch endpoint beyond normal interactive use, and don't use this service to probe systems you don't own or administer. Scanning the headers of a public site is ordinary and harmless; using the results to attack it is not, and is on you.

Caps and fair use

A check follows at most ten redirect hops, reads at most 1 MB, and is limited to 60 per hour per visitor. Those limits are what keeps the tool free and the origin shared with other sites usable; they are not negotiable per user, and scripting around them counts as abuse under the paragraph above.

Changes and contact

These terms may change as the tool evolves, and the effective date above moves when they do. Questions belong on the contact page. How data is handled is covered by the privacy policy.