Security Headers Checker
Scan any website's HTTP security headers — CSP, HSTS, X-Frame-Options, Referrer-Policy and more — with grading and one-click fixes.
About Security Headers Checker
HTTP response headers are the browser's instruction manual for how to render your site safely. Miss a header and clickjacking, XSS, mixed content or downgrade attacks become one-click exploits. This checker grades every header a modern browser respects and shows the exact value to ship — no guessing, no theory.
What this tool checks
Security Headers Checker focuses on the following signals from your site's live response:
headersmodule in the full audithstsmodule in the full auditcspmodule in the full auditreferrermodule in the full auditpermissionsmodule in the full audit
Why it matters
Signals covered by Security Headers Checker are the ones attackers, browsers, and search engines look at first. A weak result here means real users are exposed — via downgrade attacks, broken trust warnings, indexing problems, or leaked data — long before anything obvious breaks. Fixing them is usually a config change, not a rewrite, and the impact is immediate.
How to interpret your result
- Pass — the signal meets modern best practice. Keep it monitored; regressions happen after deploys.
- Warn — functional but weaker than recommended. Usually a quick header, DNS, or config tweak away from a full pass.
- Fail — a real risk to users or search visibility. Follow the recommendation shown next to the finding — it's copy-pasteable.
Best practices
- • Re-run after every deploy — configuration drift is the #1 cause of regressions.
- • Compare against a competitor's report to spot easy wins.
- • Wire the public API into CI to gate merges on the score.
- • Fix warns before failures — they're the cheapest to close and pay off compounding gains.
Frequently asked questions
Related guides
Guide
HTTP Security Headers: A Practical Guide
Every HTTP security header explained in plain English, with production-ready examples for Nginx, Apache, Cloudflare, Express and WordPress.
Read
Guide
Content Security Policy (CSP): What It Is and How to Ship It
A step-by-step guide to writing, testing and shipping a strict Content Security Policy without breaking your site.
Read
Guide
HTTP Strict Transport Security (HSTS)
How HSTS works, how to enable it safely, and when (and how) to preload your domain into every major browser.
Read
Related articles
headers
Why Your Website Needs HSTS in 2026
One header, one config line, and downgrade attacks stop reaching your users. If your site doesn't ship HSTS in 2026, you're leaving free security on the table.
Read
headers
How to Roll Out CSP in Report-Only Mode
CSP is one of the most effective XSS defenses ever shipped — and one of the most feared to deploy. Report-only mode turns a scary launch into a boring one.
Read
dns
DMARC in Plain English
SPF, DKIM, DMARC. Three DNS records, one goal: stop other people from sending email as you. Here is what each one actually does.
Read