Security Headers Checker

Enter a domain or website URL to analyse.

The Security Headers Checker requests the home page of a domain and reports which HTTP response headers the server sends to protect visitors. Missing headers are the reason browsers still allow clickjacking, MIME sniffing or a downgrade to an unencrypted connection on sites that otherwise look perfectly healthy.

What is checked

Six headers are read from the live response and each one is shown with its actual value, so you can judge the configuration and not only its presence. The page is fetched over HTTPS first, with a fallback to HTTP if no secure response is available.

Strict-Transport-Security: forces browsers to stay on an encrypted connection
Content-Security-Policy: restricts which scripts and resources are allowed to load
X-Frame-Options and Referrer-Policy: framing by other sites and referrer leakage
X-Content-Type-Options and Permissions-Policy: MIME sniffing and access to browser features
Mixed content: files still linked over http:// inside an HTTPS page

Read the score as a starting point rather than a grade: a Content-Security-Policy that allows everything counts as present but protects very little. Compare the listed values with what your site actually needs, adjust them in the web server or CDN configuration, then run the check again.

Frequently asked questions

What does the Security Headers Checker do?

It requests the home page of a domain and reports which protective HTTP response headers the server sends, including HSTS, Content-Security-Policy, X-Frame-Options and Referrer-Policy. It also lists resources that are still loaded over plain HTTP.

Why do security headers matter?

Missing headers are the reason browsers still allow clickjacking, MIME sniffing or a downgrade to an unencrypted connection on sites that otherwise look healthy. Correct headers tell the browser to enforce HTTPS, restrict framing and control what data leaves the page.

Is the Security Headers Checker free and do I need an account?

Yes, the check is completely free and no registration is required. Enter a domain and run the scan as often as you like, for your own sites or for any public site you want to compare against.

Does the check change anything on my website?

No, the tool is read-only. It simply sends a normal request to your page, like any browser would, and analyzes the response headers it receives. Nothing is installed, modified or stored on your server.

What is checked

Strict-Transport-Security: forces browsers to stay on an encrypted connection
Content-Security-Policy: restricts which scripts and resources are allowed to load
X-Frame-Options and Referrer-Policy: framing by other sites and referrer leakage
X-Content-Type-Options and Permissions-Policy: MIME sniffing and access to browser features
Mixed content: files still linked over http:// inside an HTTPS page