Security Headers Checker
Analyze your website's HTTP security headers — CSP, HSTS, X-Frame-Options, and more.
No cookies, no tracking except a page visit count. URLs are fetched server-side — never stored.
About this tool
This free security headers checker evaluates your website's HTTP response headers against industry best practices. It checks for critical security headers defined by OWASP, the Mozilla Observatory, and securityheader.com standards. Each header receives a pass/fail status, and you get a letter grade (A–F) for your overall security posture.
The test is performed server-side — we fetch your URL from Cloudflare's edge network and analyze the response headers. Your URL is not stored, logged, or shared. 100% free, no signup required.
What each critical header does
- Content-Security-Policy (CSP) — Controls which resources (scripts, styles, images) the browser can load. Reduces XSS risk dramatically.
- Strict-Transport-Security (HSTS) — Forces HTTPS connections. Prevents downgrade attacks and cookie hijacking.
- X-Frame-Options — Prevents clickjacking by controlling whether your page can be embedded in frames.
- X-Content-Type-Options — Prevents MIME-type sniffing. Set to
nosnifffor protection. - Referrer-Policy — Controls how much referrer information is sent with requests. Recommended:
strict-origin-when-cross-origin. - Permissions-Policy — Controls which browser features (camera, microphone, geolocation) your site can access.
Frequently asked questions
What are security headers?
They are HTTP response headers a server sends to harden the browser: Content-Security-Policy limits what scripts can run, Strict-Transport-Security forces HTTPS, X-Content-Type-Options stops MIME sniffing, and others control framing and referrer leakage. They cost nothing to add and block whole attack classes.
Is my URL logged or stored?
No. The lookup happens from your browser directly against the site you enter — this page has no backend that records what you scan.
Why does my site score badly even though it works fine?
Headers do not affect how a page looks, only how browsers treat it. Most sites ship without CSP or HSTS because frameworks do not add them by default. The fix is usually a few lines in your web server or hosting configuration.
Can I copy the recommended headers directly?
Yes. Each missing header comes with a suggested value you can paste into nginx, Apache, Netlify, Vercel or Cloudflare settings. Test after deploying — an overly strict CSP can break inline scripts until tuned.