Free Security Headers Checker & HTTP Analyzer

Test your website's HTTP security headers online. Check CSP, HSTS, X-Frame-Options, and essential security headers to protect against XSS, clickjacking, and attacks. Get instant A+ security scores and recommendations.

https://

No credit card required • Instant results

CSP Analysis

Check Content Security Policy configuration to prevent XSS attacks and unauthorized resource loading

HSTS Validation

Verify HTTP Strict Transport Security headers to enforce secure HTTPS connections

Missing Headers

Identify missing security headers and get recommendations to improve your website's security posture

Security Headers We Check

Essential Headers

  • Content-Security-Policy (CSP)
  • Strict-Transport-Security (HSTS)
  • X-Frame-Options
  • X-Content-Type-Options

Additional Headers

  • Referrer-Policy
  • Permissions-Policy
  • Overall security score

Why Security Headers Matter

HTTP security headers are your first line of defense against common web vulnerabilities. They tell browsers how to behave when handling your site's content, preventing attacks like cross-site scripting (XSS), clickjacking, and man-in-the-middle attacks. Our free checker analyzes your headers and provides actionable recommendations to enhance your website security.

Security headers questions

What are HTTP security headers?

They are response headers that tell the browser how to handle your site safely: which scripts may run (Content-Security-Policy), whether to always use HTTPS (Strict-Transport-Security), whether the page may be framed, and how much referrer information to share.

Which security headers matter most?

Content-Security-Policy and Strict-Transport-Security give the most protection. X-Content-Type-Options, a frame-ancestors directive or X-Frame-Options, Referrer-Policy and Permissions-Policy close smaller gaps and are easy to add.

Is having a header enough?

Not always. A Content-Security-Policy that allows unsafe-inline or any https: source is present but weak. We check values as well as presence, and the CSP Checker scores the policy in detail.

Will adding security headers break my site?

Most headers are safe to add straight away. A strict Content-Security-Policy can block scripts your site needs, so roll it out in report-only mode first and tighten it once the reports are clean.

Is the security headers checker free?

Yes, with no registration. It makes one ordinary request to your site and reads the headers that come back.

This is one check. A full scan runs them all.

Free

The Security Headers Check covers one area. A full scan runs every check on the same site in one go, so nothing it does not reach goes unnoticed.

Covered by this check

  • Content Security Policy (CSP)
  • HTTP Strict Transport Security (HSTS)
  • X-Frame-Options analysis
  • X-Content-Type-Options check
  • Referrer-Policy validation

Added by a full scan

  • SSL/TLS certificate validation
  • WordPress vulnerability scanning
  • Malware & script detection
  • DNS security (DNSSEC, CAA)
  • Web misconfiguration check
  • Domain reputation analysis
  • Certificate transparency logs
  • And 6+ more security checks
https://

Want it checked automatically? A free account rescans one site every week and emails you new findings. No credit card.

Start free monitoring

More HTTP and SSL security tools

CSP Checker

Evaluate Content-Security-Policy effectiveness, unsafe-inline, wildcards and missing directives.

HSTS Checker

Validate the Strict-Transport-Security header and preload status.

Cookie Security Checker

Audit cookies for Secure, HttpOnly and SameSite flags.

CORS Misconfiguration Checker

Detect arbitrary-origin reflection and credentialed CORS misconfigurations.

Subresource Integrity Checker

Verify SRI hashes and find third-party resources missing integrity protection.

SSL Certificate Checker

Validate the certificate, chain and expiry of any site.