Security Headers Checker

Check security HTTP headers like CSP, HSTS, X-Frame-Options, and more.

Security HTTP headers protect websites against common attacks like XSS, clickjacking, and MIME-type sniffing. Our security headers checker evaluates a website's implementation of CSP, HSTS, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy.

Result

Enter a URL to check security headers.
In Action

Security Headers in action

A pentest report flags your site for missing headers. Run the checker on each environment: it shows production has HSTS but staging does not — so you fix the right server instead of guessing, and re-run to produce proof for the report.

Frequently Asked Questions

What are security headers?

Security headers are HTTP response headers that help protect against common web vulnerabilities like XSS, clickjacking, and MIME sniffing. Setting them correctly is an essential part of web security best practices.

How do I check security headers on my website?

Enter your URL and the tool tests for HSTS, CSP, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy, marking each as present or missing with a plain-language explanation.

What does Content-Security-Policy do?

CSP tells browsers which sources are allowed to load scripts, styles, and images. A strict CSP blocks injected malicious scripts (XSS attacks) even if an attacker finds a way to inject HTML into your page.

Do security headers affect SEO?

Headers themselves are not a ranking factor, but HSTS protects against downgrade attacks that could redirect your visitors elsewhere, and a hijacked site loses rankings fast. Security headers protect the traffic you already have.