Security Headers Checker

Security headers are HTTP response headers that instruct browsers how to behave when handling your site's content. They are your first line of defence against common web attacks — Cross-Site Scripting (XSS), clickjacking, MIME-type confusion and information leakage. Setting them correctly is a low-effort, high-impact hardening step that every web server should have.

Content-Security-Policy tells the browser which sources it is allowed to load scripts, styles, images and other resources from. A properly configured CSP blocks the most common XSS attacks at the browser level — even if an attacker injects malicious code, the browser refuses to execute it. Weak policies that include "unsafe-inline" or wildcard (*) sources significantly reduce this protection.

HTTP Strict Transport Security (HSTS) tells browsers to only connect to your site over HTTPS, even if a user types "http://" or clicks a plain-HTTP link. Without it, a network attacker can intercept the first HTTP request and hijack the session before a redirect to HTTPS occurs. A max-age of at least one year (31536000 seconds), plus includeSubDomains, is the recommended baseline.

Yes — each header addresses a different attack vector, and missing any one of them leaves a gap. That said, CSP and HSTS have the most impact. Start with X-Content-Type-Options (the easiest — one line) and HSTS, then work through CSP, X-Frame-Options, Referrer-Policy and Permissions-Policy. The prioritised fixes list below your result tells you exactly what to tackle first.

No. We fetch your URL's response headers server-side and immediately return the result — nothing is stored, logged or retained. We do not crawl your site or read your content; we only inspect the headers that your web server sends in its HTTP response.