Security Headers Checker

See which HTTP security headers a website sends, what each one actually does, and whether any are misconfigured.

What is a security headers checker?

A security headers checker looks at the instructions a website gives browsers about how to protect visitors. Security headers are optional HTTP response headers: they can force HTTPS, limit where scripts load from, stop the site being framed by others and control what information leaks to other sites. Missing security headers leave browsers using their more permissive defaults.

This tool checks six widely recommended headers and explains each one, so you can see what is in place and what is missing.

How the security headers check works

The tool requests the address you enter, follows up to five redirects, and reads the headers from the final response. Each header is marked as Present, Missing or Configuration issue. A configuration issue means the header is there but set in a way that does not work, for example:

Strict-Transport-Security without max-age, or with max-age=0.
X-Frame-Options with a value browsers do not recognise.
Content-Security-Policy set to default-src *, which allows everything.

How to check your security headers

Enter your domain or a specific page.
Press Check Headers.
Read the summary of missing headers and configuration issues.
Work through the table; each row explains what the header does.

The six security headers explained

Strict-Transport-Security (HSTS)

Tells browsers to use HTTPS only, even when someone types or follows an http:// link.

Content-Security-Policy (CSP)

Lists the sources allowed to provide scripts, styles, images and other content, which limits the damage from injected code.

X-Content-Type-Options

Set to nosniff, it stops browsers guessing a file's type, which blocks some attacks that disguise scripts as other files.

X-Frame-Options

Controls whether other sites can show your page in a frame, protecting against clickjacking. Use DENY to block all framing or SAMEORIGIN to allow only your own site.

Referrer-Policy

Controls how much of your page address is sent to other sites when visitors click a link.

Permissions-Policy

Limits which browser features, such as the camera, microphone or location, the page and its embedded content may use.

Why missing security headers matter

Without these headers, browsers fall back to permissive defaults: any site can show your pages in a frame, full page addresses may be passed to other sites, and a single injected script can load code from anywhere. Each header closes one of these gaps at almost no cost, which is why security reviews and audits routinely ask for them.

An example starting set

Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()

Content-Security-Policy is not included because a useful policy depends on exactly which scripts, fonts and services your site uses. Build your own from a report-only trial rather than copying another site's.

Common uses

Checking a site's protection before a security review.
Confirming header changes went live after editing server settings.
Comparing your headers with a competitor's.
Checking that a security plugin really sends the headers it promises.

Common problems and fixes

Several headers are missing. Add them in your web server configuration, CDN rules or a security plugin. Begin with the low-risk headers from the example set above.

CSP breaks parts of the site. Start with Content-Security-Policy-Report-Only to see what would be blocked, then tighten the policy step by step.

Your CMS adds its own headers. Some platforms and security plugins set headers too, which can create duplicates with different values. Keep each header in one place.

Headers appear on some pages only. Rules may apply to certain folders or file types. Check several pages.

Related tools

HSTS Checker examines Strict-Transport-Security in detail.
HTTP Headers Checker lists every response header, including caching.
Website Security Checker combines headers with SSL checks.
Website Health Checker includes three of these headers in its score.

Frequently asked questions

What are security headers?

Security headers are HTTP response headers that tell browsers how to protect visitors on your site. They can force HTTPS, restrict where scripts load from, stop other sites framing your pages and limit what information is shared. They cost nothing to add and work in every modern browser.

Which security headers should every website have?

A good baseline is Strict-Transport-Security, X-Content-Type-Options set to nosniff, X-Frame-Options or a CSP frame-ancestors rule, and Referrer-Policy. Content-Security-Policy and Permissions-Policy add stronger protection but need more planning, because a strict CSP can block parts of a site if it is set up carelessly.

How do I add security headers to my site?

On Apache you can add them with the Header directive, for example in an .htaccess file, and on Nginx with add_header. CDNs such as Cloudflare offer header rules, and many hosting panels and CMS security plugins have simple settings. Test the site after each change.

What does "Configuration issue" mean?

The header is present but set in a way that does not protect visitors. Examples are HSTS without a max-age, HSTS with max-age=0, an unrecognised X-Frame-Options value, or a Content-Security-Policy that allows every source. The detail column shows the exact value received.

Will adding security headers break my website?

Most will not. X-Content-Type-Options, Referrer-Policy and X-Frame-Options are low risk. Content-Security-Policy can block scripts or styles your site needs, so try it in report-only mode first. HSTS is hard to undo once browsers have stored it, so make sure HTTPS works everywhere before enabling it.

Is X-Frame-Options still needed if I use CSP?

The CSP frame-ancestors directive is the modern replacement and takes priority in current browsers. Many sites still send X-Frame-Options as well for older browsers. Sending both is harmless as long as they agree. This tool checks X-Frame-Options as its own header.

Do security headers help with SEO?

Not directly. Search engines do not rank sites on security headers. They do protect visitors and your reputation, and HSTS supports HTTPS, which search engines prefer. Think of them as a security measure with no downside for search rather than an SEO tactic.