Web
Security Header Checker
Check security headers
Tool features
4 checks
Security Header Analysis
Comprehensive analysis of HTTP security headers
CSP & HSTS Validation
Check Content Security Policy and HSTS configuration
Performance Insights
Response time and protocol analysis
Security Grading
Get an A-F security grade with detailed scoring
What are HTTP security headers & how they work
HTTP security headers are response headers that instruct the browser how to behave when handling a site's content — which scripts to trust, whether to force HTTPS, whether the page can be framed, and more. Set correctly, they neutralise entire classes of attacks such as cross-site scripting (XSS), clickjacking, and protocol downgrade.
This checker fetches a URL, inspects the security headers it returns, and grades the result — showing which protections are present, which are missing, and how to add them. Because these headers are opt-in, most sites ship without a full set, so an audit almost always surfaces quick, high-impact hardening wins.
Content-Security-Policy
Whitelists the sources a page may load scripts, styles, and other resources from — the strongest defence against XSS.
Strict-Transport-Security
Forces browsers to use HTTPS for the domain, preventing downgrade and cookie-hijacking attacks.
X-Frame-Options
Controls whether your pages can be embedded in a frame, blocking clickjacking attempts.
How to use this tool
1
Enter a domain or URL
Type the site you want to audit, for example https://example.com or example.com.
2
Run the security audit
We fetch the response and check for each recommended security header.
3
Review the grade and gaps
See your overall grade plus which headers are present, missing, or misconfigured.
4
Add the missing headers
Apply the recommendations in your server, framework, or CDN to close the gaps.
Related tools
5 tools
HTTP Header Checker
Analyze HTTP response headers for any website or URL with detailed header information
OCSP Checker
Check SSL certificate revocation status using the Online Certificate Status Protocol (OCSP)
HSTS Checker
Check HTTP Strict Transport Security (HSTS) header configuration and preload status
X-Frame Options Checker
Check X-Frame-Options header to prevent clickjacking attacks and iframe embedding
HTTP/3 Test
Check if H3/QUIC is enabled on your website. Test HTTP/3 support and analyze Alt-Svc headers
Frequently asked questions
5 Q&A
Set them wherever you control the response — your web server (Nginx/Apache), application framework, or CDN/edge config. They must be sent on every response, not just the homepage.
It can if the policy is too strict, because CSP blocks resources it doesn't explicitly allow. Roll it out gradually using Content-Security-Policy-Report-Only first, then enforce once the reports are clean.
An HTTP header checker lists every response header (caching, performance, server info). This tool focuses specifically on security headers and grades your protection against common web attacks.
Re-audit after any deployment that changes headers, adds third-party scripts, or moves infrastructure — and periodically as a routine check, since misconfigurations can creep in over time.