How it works
The Security Headers Checker analyzes the HTTP response headers of any URL and grades them against security best practices — identifying missing or misconfigured security headers that expose users to common web attacks.
HTTP security headers are a first line of defense. They tell browsers how to behave when loading and executing page content: whether to enforce HTTPS, whether to allow framing, whether to trust inline scripts, and how much referrer information to share. Correctly configured headers prevent entire classes of attacks without requiring changes to application code.
How to use it: enter any URL. The tool fetches the response headers (through a proxy) and evaluates them against a security checklist. Each header is shown as Pass, Warn, or Fail with a detailed explanation and recommendation. An overall security grade (A+ through F) summarizes the findings.
Headers analyzed: - Strict-Transport-Security (HSTS): forces browsers to use HTTPS for future visits, preventing SSL-stripping attacks - Content-Security-Policy (CSP): whitelist of allowed content sources, blocking XSS attacks - X-Frame-Options or CSP frame-ancestors: prevents clickjacking by controlling iframe embedding - X-Content-Type-Options: nosniff prevents MIME-type sniffing attacks - Referrer-Policy: controls how much referrer URL is shared with other sites - Permissions-Policy: restricts browser feature access (camera, microphone, geolocation) - Cross-Origin-Opener-Policy (COOP) and Cross-Origin-Embedder-Policy (COEP): isolation for SharedArrayBuffer
Grade meaning: an A+ means all recommended headers are present and correctly configured. A bare F means several critical headers are missing, leaving users exposed to preventable attacks.
Frequently Asked Questions
- A low security header score means your site is missing browser-side defenses against common attacks. It doesn't mean you've been hacked — but it means users' browsers won't apply available protections. Each missing header is a specific, actionable recommendation.
- In your web server configuration (Apache: Header directive in httpd.conf or .htaccess, Nginx: add_header in server block), in your application framework (Express.js middleware like helmet, Django SECURE_ settings, Next.js headers() config in next.config.js), or in your CDN configuration (Cloudflare, Vercel, Netlify all support custom response headers).
- CSP is the most complex security header. A strict CSP that blocks inline scripts and only allows your own domain requires significant testing to avoid breaking functionality. Start with Content-Security-Policy-Report-Only mode, which reports violations without blocking — then tighten the policy once you've captured all legitimate sources.
- Yes. Once a browser sees HSTS (Strict-Transport-Security), it will only use HTTPS for that domain for the max-age duration (typically 1 year). If your HTTPS certificate expires or you need to temporarily serve HTTP, users with HSTS cached will get errors. Set max-age conservatively (e.g., 86400 = 1 day) initially, then increase after confirming your HTTPS is stable.