🛡️ Security Headers Checker
Check a website's HTTP security headers — HSTS, Content-Security-Policy, X-Frame-Options and more — with plain-language explanations. Useful for webmasters hardening their sites. Free, unlimited.
How to use
- Enter a website URL (e.g. example.com) — http:// or https:// both work.
- Click Check Headers — we fetch the site's response headers for you.
- Green means the header is present and well-configured; red means it's missing or weak.
- Expand each result to read what the header does and how to add it on your server.
FAQ
Is it really free?
Yes — every tool on this site is 100% free with no limits, no signup and no watermarks.
Why are some sites not checkable?
A few sites block cross-origin header checks. For a deeper scan, try securityheaders.com as well.
Why are some sites not checkable?
Some sites block cross-origin header reads, require JavaScript rendering, or sit behind aggressive bot protection. Very large corporate sites and those with strict CORS policies may refuse the check — try again later or test a staging copy.
What is the single most important header?
Strict-Transport-Security (HSTS). It forces browsers to use HTTPS always, killing SSL-stripping attacks. One line, enormous protection — but test carefully, because misconfigured HSTS can lock visitors out.
Will adding headers break my site?
Rarely, but Content-Security-Policy is the exception — an overly strict CSP blocks your own scripts, fonts, or embeds. Deploy new headers in report-only mode first, watch the console, then enforce.
Do these headers replace a WAF or updates?
No. Headers are one layer of defense-in-depth. They don't patch vulnerable software, stop DDoS, or replace a web application firewall — they harden the browser's behavior when visiting your already-secured site.
Security Headers Checker — Complete Guide
HTTP security headers are invisible instructions your server sends with every page, telling browsers how to behave: enforce HTTPS, block clickjacking, stop MIME sniffing, and sandbox scripts. Most sites miss several. This Security Headers Checker grades any URL in seconds and explains each finding.
The essential headers
- Strict-Transport-Security (HSTS): forces HTTPS on all future visits. Include subdomains and preload for maximum effect.
- Content-Security-Policy (CSP): whitelists where scripts, styles, and images may load from — the strongest XSS defense available.
- X-Frame-Options / frame-ancestors: stops other sites embedding your pages in invisible iframes (clickjacking).
- X-Content-Type-Options:
nosniffprevents browsers from misinterpreting file types. - Referrer-Policy: controls how much of your URL leaks to other sites via the Referer header.
- Permissions-Policy: disables browser features (camera, mic, geolocation) your site doesn't need.
How to read your grade
Green means present and correctly configured. Red means missing — each red row is a concrete hardening task, not abstract advice. Amber or warnings usually mean the header exists but with a weak value (like a short HSTS max-age). Fix reds first, then tune ambers.
Deployment tips
- Start with the easy wins: HSTS, X-Content-Type-Options, and Referrer-Policy are one-liners with near-zero breakage risk.
- CSP needs staging: build your policy with
Content-Security-Policy-Report-Onlyfirst, collect violation reports, then enforce. - Server config, not code: set headers in Nginx/Apache/Cloudflare once and they apply site-wide — cleaner than per-page meta tags.
- Recheck after changes: run this tool again after each deployment to confirm the headers actually shipped.
Beyond headers
Headers complement — never replace — patching, WAFs, and secure coding. Think of them as seatbelts: essential, but you still need brakes. Pair a clean header report with HTTPS everywhere, updated software, and regular backups for a genuinely hardened site.
Scoring context
A missing header is not a vulnerability by itself — it's a missing seatbelt. Your risk depends on what your site does: a static blog needs fewer headers than a banking app handling sessions and payments. Prioritize based on your threat model, but treat HSTS and X-Content-Type-Options as universal.
Keep improving
Re-run this check after every major deployment and quarterly as routine hygiene. Headers can silently vanish during migrations, CDN changes, or framework upgrades — a two-minute check catches regressions before attackers do.