PluginStats
Security Headers users statistics
Chrome Web Store · Developer Tools
Security headers checker with letter grade, severity levels, batch scan, site compare, fix snippets, and shareable report card.
Security Headers has approximately 191 recorded users on Chrome Web Store, ranking #1895 of 2,495 tracked listings.
About Security Headers
Security headers checker with letter grade, severity levels, batch scan, site compare, fix snippets, and shareable report card.
Security Headers is a fast, privacy-first Chrome extension that inspects the HTTP response headers on any website and gives you an instant letter grade. v1.3.0 fixes three grading accuracy bugs and adds a 58-test regression suite — making it the most accurate header checker in the marketplace.
HOW IT WORKS:
- Open any website
- Click the extension icon
- Hit "Scan This Page" — get an instant letter grade (A+ to F)
- Expand any header for a deep dive: what attack it prevents, a real-world breach example, and a ready-to-paste fix snippet for Nginx, Apache, Express, or Cloudflare
WHAT'S NEW IN v1.3.0:
CSP Evaluator Tightened — Either 'unsafe-inline' OR 'unsafe-eval' alone now correctly flags as weak (previously required both keywords to appear). Aligns with Mozilla Observatory and securityheaders.com baselines. Most sites with React/Vue/Tailwind defaults will see a more accurate CSP score.
Referrer-Policy Bug Fix — Permissive values like 'origin' and 'no-referrer-when-downgrade' now correctly show as weak. Previously these were incorrectly marked as good, hiding real referrer-leakage risk.
Permissions-Policy Parser — Replaced the length-based heuristic with a real parser. Wildcard directives like 'camera=*' now correctly flag as weak. Strict policies like 'camera=()' correctly show as good.
58-Test Regression Suite — Every evaluator now has unit tests so future updates can't silently break what's working.
Some sites may see grade adjustments — these are corrections to previously-misreported scores, not changes in your security posture.
CORE FEATURES:
- Checks 10 critical HTTP security headers
- Instant letter grade with color-coded results
- Expandable per-header detail with attack examples and real-world breach references
- Per-framework fix snippets (Nginx, Apache, Express, Cloudflare)
- Critical / Important / Optional severity classification
- Batch-scan any number of URLs with CSV export
- Side-by-side site compare
- Share report as PNG image
- Scan history (last 50 scans)
- Extension badge shows the letter grade at a glance
- 100% local — no data leaves your browser
HEADERS CHECKED:
- Content-Security-Policy (XSS, injection, clickjacking)
- Strict-Transport-Security (protocol downgrade attacks)
- X-Frame-Options (clickjacking)
- X-Content-Type-Options (MIME sniffing)
- Referrer-Policy (referrer leakage)
- Permissions-Policy (unauthorized feature access)
- Cross-Origin-Opener-Policy (cross-origin isolation)
- Cross-Origin-Resource-Policy (resource read protection)
- Cross-Origin-Embedder-Policy (Spectre-class defenses)
- X-XSS-Protection (legacy, deprecated)
WHO IT'S FOR:
- Web developers auditing their own sites
- Security engineers doing quick header reviews
- DevOps teams comparing staging and production
- Anyone learning what each security header actually does
PRIVACY FIRST:
- All scans happen locally in your browser
- No data is ever sent to external servers
- No accounts, no sign-ups, no tracking
- History is stored locally and can be cleared any time
FREE TO USE: Security Headers is completely free with no hidden costs and no ads.
Description from the Chrome Web Store listing.
README badge
Show your rank in a README or on your website. The badge updates automatically.
Charts
Images: 30d · 1y · all time · 1600×900 dark
Adoption over time
7/30/90-day growth
Ranking history
Ratings over time
Listing placement
Listing placement
Filled points are observed values; hollow points come from Internet Archive snapshots of the listing page. Dashed segments span periods with no observations — values between points are not interpolated.
Each band is one page of 20. Users on a linear scale. Placement is projected from users, so it can differ from the marketplace's own sort order. Hover a dot to see the listing.
Recent observations
Full history (1)Similar Chrome Web Store Developer Tools plugins
All 20 Security Headers alternatives
Data source
Covers every Chrome Web Store extension with at least 100 users, found through the store's public sitemap. User counts are read from public listing pages. The 10% most-used extensions are refreshed daily, the next 40% weekly and the next 40% monthly; the least-used 10% are not refreshed. Google displays rounded user counts (and caps the display at 10,000,000+), so small changes may not be visible. Rating counts above 1,000 are rounded (e.g. 1.6K).
Listing: https://chromewebstore.google.com/detail/security-headers/oahaipcejmlamohcchffgpcnfbidaklj. First seen Oct 19, 2026; last successful collection Oct 19, 2026. See the methodology.