Security Headers Checker
Eight headers your website either sends or does not. Unlike most tools of this kind, this one will not mark you down for a header that stopped mattering in 2019, or for skipping an old header when you send the modern one that replaced it.
What this checks
- The headers that do real work: HSTS, which keeps browsers on HTTPS, and Content-Security-Policy, which limits what a page may load and run.
- Whether the values are meaningful rather than merely present — a short HSTS lifetime, or a policy that permits inline scripts and so permits almost everything.
- Headers that are superseded, shown as superseded. If your policy sets frame-ancestors, you are not told off for skipping X-Frame-Options.
- Headers that modern browsers ignore, marked as legacy, so nobody pays to add one.
What this cannot tell you
- Headers are one layer. A site with all eight can still be broken into through its software, its passwords or its plugins, and a site missing several can be perfectly safe.
- This reads one page. A site can send different headers on different paths, and an admin area often sends stricter ones than a home page.
- We do not test for vulnerabilities, probe your server or try anything. This reads the headers that came back with an ordinary page request, and nothing more.
Questions people ask
Is my site unsafe if a header is missing?
No. These headers reduce the damage certain attacks can do; they are not the thing standing between you and being broken into. A missing one is worth adding when it is cheap, and is not an emergency. Any tool that gives you a red F for a missing header is selling urgency.
Which one should I add first?
HSTS, if your site is on HTTPS and you intend to keep it there. It is one line, it is well understood, and it closes a real gap — the first request a visitor makes before any redirect happens. Content-Security-Policy does more but takes real work to do without breaking your own pages.
Why no score out of a hundred?
Because it would be made up. A grade implies that a weighted sum of eight headers describes whether a website is safe, and it does not. Worse, it sends people chasing an A on a site where several of these do not apply. You get the list, what each one is doing, and which gaps are worth closing.