Security headers checker
Security headers tell browsers how to protect your visitors: force HTTPS, block injected scripts, stop clickjacking, protect session cookies. See which ones your site sends, how strong they are, and what is missing.
Reads only public data. Results are not stored.
What this tool checks
One ordinary request to your home page - the same one a browser makes - is enough to see the headers. Missing HSTS exposes logins on public Wi-Fi, a missing CSP turns any injection bug into a full cross-site scripting attack, and cookies without Secure or HttpOnly can be stolen.
- Site is served over HTTPS
- HSTS enabled with a long lifetime
- Content-Security-Policy restricts scripts
- MIME sniffing disabled (X-Content-Type-Options)
- Clickjacking protection (X-Frame-Options / frame-ancestors)
- Referrer-Policy set
- Permissions-Policy set
- Cookies flagged Secure, HttpOnly and SameSite
- Server software versions hidden
Questions
Which security headers matter most?
Strict-Transport-Security and Content-Security-Policy, followed by X-Content-Type-Options, framing protection (X-Frame-Options or CSP frame-ancestors), Referrer-Policy and Permissions-Policy, plus Secure, HttpOnly and SameSite on cookies.
Can headers break my site?
HSTS and CSP can, if set carelessly: enable HSTS only once every page is on HTTPS, and start CSP in report-only mode. The other headers are safe to add.
Where do I set these headers?
In the web server (nginx, Apache), the application, or the CDN. Each finding links to ready-made configuration.