Security Headers Checker

Score HSTS, CSP, X-Frame-Options and the other headers browsers actually enforce

100% free. This tool needs our server to do the work, so what you submit is sent there, processed and then discarded - it is never stored.

Jump to the next useful tool without leaving your flow.

See more

About this tool

Browsers only enforce the headers a site actually sends. This checker looks up a URL and scores six of the ones that matter day to day: Strict-Transport-Security (HSTS), Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. Each row shows the value or "Missing" and a one-line why. A green 6/6 is not a pentest. CSP can still be weak if it is present but wide open. Use this as a shipping checklist, then read the values.

How to use this tool

  1. Enter the URLHTTPS home or any public path. The response headers of that URL are read.
  2. CheckEach of the six headers is marked present or missing with its value.
  3. Fix at the hostAdd headers on the CDN or origin. Re-check after cache expires.

Which security headers to add first

Start with Strict-Transport-Security (HSTS), which forces HTTPS, and X-Content-Type-Options: nosniff - both are easy and rarely break anything. Add Referrer-Policy: strict-origin-when-cross-origin and frame protection with X-Frame-Options or CSP frame-ancestors.

Content-Security-Policy gives the strongest protection against cross-site scripting but needs testing: start in report-only mode, fix what it reports, then enforce it.

Key features

  • HSTS, CSP, frame options, nosniff, referrer and permissions in one score.
  • Explains why each header exists, not only a letter grade.
  • Fast fetch, no account.

Common uses

  • Pre-launch checklist on a new marketing domain.
  • Confirming HSTS after an HTTPS cutover.
  • Seeing whether CSP exists before a client security questionnaire.

Tips for better results

  • frame-ancestors in CSP can replace X-Frame-Options. If CSP is strong, a missing XFO is less urgent.
  • HSTS should include includeSubDomains and a long max-age only when every subdomain is on HTTPS.
  • A CSP of default-src * is present but not useful. Read the value.

Mistakes to avoid

  • Stopping at "CSP exists" without reading unsafe-inline.
  • Enabling HSTS preload on a host that still has HTTP subdomains.
  • Thinking this scan finds SQL injection. It is headers only.

Frequently asked questions

Strict-Transport-Security and X-Content-Type-Options are the quickest wins: one line each, and they rarely break anything. Content-Security-Policy gives the most protection but needs testing, because a strict policy blocks inline scripts and third-party code the site may rely on - roll it out in report-only mode first.

strict-transport-security, content-security-policy, x-frame-options, x-content-type-options, referrer-policy and permissions-policy. Each has a short reason on the result card.

nosniff. Anything else, or missing, fails the intent of that header.

It is flagged. A CSP frame-ancestors directive can do the same job. This page still reports XFO separately so you can see the raw header.

Yes. Not a replacement for a full security review.