Security Headers Checker
Analyze your website's HTTP security headers. Check for HSTS, CSP, X-Frame-Options, and other critical security configurations.
Frequently Asked Questions
Which security headers actually matter?
Content-Security-Policy does the most work by limiting where scripts and other resources may load from. Strict-Transport-Security forces HTTPS on repeat visits. X-Content-Type-Options stops MIME sniffing, and Referrer-Policy controls what you leak to third parties. Frame protection is handled through CSP frame-ancestors.
Is X-Frame-Options still needed?
It is superseded by the CSP frame-ancestors directive, which is more expressive and is what modern browsers prefer. Sending both is harmless and still worth doing if you need to support older clients.
Is the Security Headers free to use?
Yes. Every tool on this site is completely free, with no account, no signup, and no paid tier to upgrade to.
Do I need to install a browser extension or any software?
No. The Security Headers runs online, in the browser you already have. It works the same on desktop and mobile, and there is nothing to download, install, or add to Chrome.
Related Tools
Related Reading
Why Security Headers Matter
HTTP security headers are your first line of defense against common web attacks. They instruct browsers how to handle your content and protect users from threats like XSS, clickjacking, and data injection attacks.
HSTS (Strict-Transport-Security)
Forces browsers to only connect via HTTPS, preventing protocol downgrade attacks and cookie hijacking. Essential for any site handling sensitive data.
Content-Security-Policy (CSP)
Controls which resources (scripts, styles, images) can be loaded on your page. Prevents XSS attacks by blocking unauthorized code execution.
X-Frame-Options
Prevents your site from being embedded in iframes on other domains, protecting against clickjacking attacks where attackers trick users into clicking hidden elements.
X-Content-Type-Options
Prevents browsers from MIME-sniffing responses, ensuring content is treated exactly as declared. Stops attacks that exploit browser content interpretation.
Referrer-Policy
Controls how much referrer information is included when navigating away from your site. Protects user privacy and prevents sensitive URL data leakage.
Permissions-Policy
Restricts which browser features (camera, microphone, geolocation) can be used on your site. Reduces attack surface and protects user privacy.
Grade Breakdown:
- A (85-100) - Excellent security
- B (70-84) - Good, minor gaps
- C (50-69) - Fair, needs improvement
- D (30-49) - Poor security posture
- F (0-29) - Critical vulnerabilities
Need Help Securing Your Website?
Our team can help configure your security headers and implement best practices to protect your website and users. Book a free discovery call to discuss your needs.