Security Headers Checker

Analyze your website's HTTP security headers — CSP, HSTS, X-Frame-Options, and more.

No cookies, no tracking except a page visit count. URLs are fetched server-side — never stored.

Free and EUComply Pro, side by side
Plan	Free	EUComply Pro
What you get	The critical security headers of one response, pass or fail A letter grade from A to F Every response header, plus the raw response	It reads the page source as well — consent banner, trackers, privacy link and metadata, which no response header shows 18 server-side GDPR, cookie, security and metadata checks The findings as a PDF report you can hand a client
Price	$0no licence key needed	$79/year per website

About this tool

This free security headers checker evaluates your website's HTTP response headers against industry best practices. It checks for critical security headers defined by OWASP, the Mozilla Observatory, and securityheader.com standards. Each header receives a pass/fail status, and you get a letter grade (A–F) for your overall security posture.

The test is performed server-side — we fetch your URL from Cloudflare's edge network and analyze the response headers. Your URL is not stored, logged, or shared. 100% free, no signup required.

What each critical header does

Content-Security-Policy (CSP) — Controls which resources (scripts, styles, images) the browser can load. Reduces XSS risk dramatically.
Strict-Transport-Security (HSTS) — Forces HTTPS connections. Prevents downgrade attacks and cookie hijacking.
X-Frame-Options — Prevents clickjacking by controlling whether your page can be embedded in frames.
X-Content-Type-Options — Prevents MIME-type sniffing. Set to nosniff for protection.
Referrer-Policy — Controls how much referrer information is sent with requests. Recommended: strict-origin-when-cross-origin.
Permissions-Policy — Controls which browser features (camera, microphone, geolocation) your site can access.

Frequently asked questions

What are security headers?

They are HTTP response headers a server sends to harden the browser: Content-Security-Policy limits what scripts can run, Strict-Transport-Security forces HTTPS, X-Content-Type-Options stops MIME sniffing, and others control framing and referrer leakage. They cost nothing to add and block whole attack classes.

Is my URL logged or stored?

No. The lookup goes through our server, which fetches the headers and sends them back. We do not store the URL you entered or the result, and we set no cookies. What we do keep is a salted hash of your IP address for the current hour, so that one script cannot use up the check for everyone else; it expires after two hours.

Why does my site score badly even though it works fine?

Headers do not affect how a page looks, only how browsers treat it. Most sites ship without CSP or HSTS because frameworks do not add them by default. The fix is usually a few lines in your web server or hosting configuration.

Can I copy the recommended headers directly?

Yes. Each missing header comes with a suggested value you can paste into nginx, Apache, Netlify, Vercel or Cloudflare settings. Test after deploying — an overly strict CSP can break inline scripts until tuned.

This check is free. The rest of your site's security is not.

Headers are one line of a site's security posture, and they are the line a scan reads best. EUComply Pro reads the same headers for the site you name and adds what this page cannot see: HTTPS enforcement, mixed content and form submission security, next to 15 accessibility checks — 33 in all, in a PDF report you can hand to a client or your compliance officer.