Security headers checker
Analyse the HTTP security headers your website sends with every response. Identify missing headers and misconfigurations that expose your visitors to attack.
Enter a URL and press Check Headers to audit the HTTP security headers.
HTTP security headers are your website's first line of defence against common attacks including clickjacking, MIME sniffing, cross-site scripting and protocol downgrade attacks. Each header tells the browser how to behave when loading your content.
Headers we check
Strict-Transport-Security (HSTS) forces browsers to connect over HTTPS only, even if the user types HTTP. A missing HSTS header leaves your visitors vulnerable to SSL-strip attacks on public Wi-Fi. Set a max-age of at least one year (31536000) and add the includeSubDomains directive for full coverage.
Content-Security-Policy (CSP) controls which domains the browser is allowed to load scripts, styles, fonts and images from. A well-tuned CSP prevents XSS attacks by blocking inline scripts and untrusted origins. Start with a restrictive policy and widen it as you discover legitimate resources.
X-Frame-Options prevents your pages from being embedded in iframes on other domains, which is the primary defence against clickjacking attacks. Set it to SAMEORIGIN or DENY depending on whether you embed your own pages in frames.
X-Content-Type-Options with the value nosniff stops browsers from MIME-sniffing the response type. Without it, a misidentified script file could be executed as HTML, enabling XSS.
Referrer-Policy controls how much referrer information is sent when a user clicks a link from your site. For privacy, strict-origin-when-cross-origin is the recommended default.
Permissions-Policy restricts which browser APIs and features (camera, microphone, geolocation) your pages can access. Each unused API you disable reduces your surface area for potential abuse.
Frequently asked questions
Strict-Transport-Security (HSTS) forces browsers to always use HTTPS and is the single most impactful header for preventing man-in-the-middle attacks.
Content-Security-Policy and Permissions-Policy can block legitimate resources if misconfigured. Always test in a staging environment first.
Headers are set on the web server (Apache, Nginx, IIS) or in your hosting control panel. Many hosting providers include a security headers section you can configure directly.
Need help securing your website?
Our team can implement all recommended security headers, set up CSP monitoring and harden your server configuration.
Or message us on WhatsApp — replies within business hours.