HTTP Security Headers Checker
Enter a domain to see which security headers it sends — and, more usefully, whether the ones it does send actually do anything. A Content-Security-Policy can be present, valid, and protect against nothing at all. Most checkers award that a green tick.
One HTTPS request to the homepage, headers only — the page body is never downloaded, redirects are not followed, and nothing is stored.
Present is not the same as protecting
This is the whole reason the tool exists. Every one of these headers can be set in a way that satisfies a checklist and stops no attack:
- A
Content-Security-Policyofupgrade-insecure-requestsis a real, valid CSP. It rewriteshttp://references tohttps://and does nothing whatsoever about cross-site scripting, because it sets no script source. Strict-Transport-Security: max-age=0switches HSTS off.- A CSP containing
'unsafe-inline'permits exactly the inline script that CSP exists to block. Referrer-Policy: unsafe-urlis a policy — one that leaks every URL you link from.X-Frame-Options: ALLOW-FROMhas been ignored by every current browser for years.
So each result below is marked ok, weak or missing rather than present or absent, and only the ones that genuinely do something count toward the score.
What each header does
Strict-Transport-Security
Tells the browser to refuse plaintext for this domain from now on. Without it, the very first visit —
typing the domain without https:// — travels over HTTP long enough to be intercepted, and
the redirect you rely on happens after that. Six months is the usual minimum; preload lists want a year
plus includeSubDomains.
Content-Security-Policy
The only header here that meaningfully limits cross-site scripting, and by far the hardest to get
right. A policy is only doing that job if it sets default-src or script-src.
Anything else is housekeeping.
X-Content-Type-Options
One value, nosniff, and it stops browsers guessing a file’s type from its contents. That
guessing is how an uploaded image gets executed as script.
Framing control
Either X-Frame-Options or, better, frame-ancestors in your CSP. Without one,
your page can be loaded invisibly over another site so that clicks intended for that site land on yours.
If you have frame-ancestors, X-Frame-Options is redundant rather than missing —
this tool treats it that way.
Referrer-Policy
Controls how much of the current URL is handed to sites you link to. Modern browsers default to something sensible, but stating it explicitly means you are not relying on that default.
Permissions-Policy
Switches off browser features — camera, microphone, geolocation — for your page and anything embedded in it. Most valuable on pages that embed third-party frames.
Headers are the cheapest security work available. They are lines in a server config or
.htaccess, they need no code changes, and they close whole categories of attack. The one
to think about before shipping is HSTS: once a browser has seen a long max-age it will
refuse plaintext for that long, so start at max-age=300, confirm nothing breaks, then
raise it.
What this check can’t tell you
- It reads the homepage only. Headers are often set per-directory, so a login page or an API path may differ from what you see here.
- It does not judge the certificate. Peer verification is deliberately off so a site with a broken certificate can still be inspected. Use the SSL Checker for that.
- It does not follow redirects. If the homepage redirects, you are told so — chasing it would mean checking headers on a host you did not ask about.
- A perfect score is not a secure site. These headers are one thin layer. They do nothing about your authentication, your database queries or your dependencies.
- HTTPS on port 443 only. No scheme or port option, deliberately — headers sent over plaintext protect nothing, and a port parameter would make this a port scanner.
Fixing them
On Apache these go in .htaccess, on nginx in the server block. A reasonable starting set,
with HSTS deliberately short so you can test safely:
| Header | A sane starting value |
|---|---|
| Strict-Transport-Security | max-age=300 then raise |
| X-Content-Type-Options | nosniff |
| Referrer-Policy | strict-origin-when-cross-origin |
| X-Frame-Options | SAMEORIGIN |
| Permissions-Policy | camera=(), microphone=(), geolocation=() |
| Content-Security-Policy | Start in report-only. This one needs real thought. |
Headers are one layer. These cover the others.
SSL Checker DMARC Checker DNS PropagationFrequently asked questions
Why did my site score badly when it has a CSP?
Almost certainly because the policy sets no default-src or script-src. A CSP
of only upgrade-insecure-requests is the usual case — extremely common, because some hosting
panels add it automatically and site owners reasonably assume they are covered.
Will adding these break my site?
CSP can, easily, which is why it belongs in report-only mode first. The others are close to
risk-free, with the exception of HSTS — that one is hard to reverse once browsers have cached a long
max-age.
Do I need X-XSS-Protection?
No. It is obsolete, removed from browsers, and was itself the source of vulnerabilities. It is not checked here.
Why is my score lower than on another tool?
Because most graders award points for a header existing. This one asks whether the value does anything, so a site with six present-but-toothless headers scores well elsewhere and poorly here.