Practical example
Review CSP, HSTS, frame protection, MIME sniffing, and referrer policy on both the homepage and a representative authenticated response.
Security Headers Checker
Enter your website URL to scan for crucial security headers and see how to improve your site's security.
About Security Headers Checker
This tool analyzes your website's HTTP headers to check for crucial security parameters that protect against XSS, clickjacking, and other attacks.
It provides an overall security grade and detailed recommendations on how to configure each header for maximum protection.
How to use
- Enter your full website URL (e.g., https://example.com).
- Click the Check Headers button.
- Review the grade and the list of detected or missing headers.
- Use the recommendations to improve your server configuration.
Tips
- Aim for an A+ grade by configuring all recommended headers.
- Use a strict Content Security Policy (CSP) to defend against XSS.
- Always enable HSTS (Strict-Transport-Security) to enforce HTTPS.
Related guides
Learn the workflow behind this tool and what to check next.
Web security
How to review security headers, CSP, and HSTS
A rollout workflow for understanding which layer sets each header, testing real browser behavior, and avoiding lockouts or false confidence.
Read guide
Domains and infrastructure
Domain launch validation checklist
A layered domain launch check that catches DNS, certificate, routing, mail, and SEO mistakes before users find them.
Read guide
Technical SEO
Technical SEO checks before submitting a site
A focused checklist for making sure search engines can discover, crawl, understand, and index important pages.
Read guide
Security header checks before publishing
HTTP security headers reduce common browser-side risks. Use the report as a deployment checklist, then verify changes in production.
HTTPS enforcement
Check HSTS only after HTTPS is stable on all subdomains you intend to include.
Framing control
Use frame-ancestors or X-Frame-Options to reduce clickjacking unless embedding is an intentional product requirement.
Content policy
Review CSP findings carefully because strict policies can block scripts, images, analytics, and third-party widgets.
Environment parity
Compare staging and production headers when a proxy, CDN, or application server sets headers in different places.
A practical example, an edge case, and a maintainer note
Edge case
A strong CSP in report-only mode does not block anything, and a header added only to 200 responses may disappear on errors or redirects.
Maintainer note
I verify effective browser behavior and rollout reports; a checklist of present header names is not a security assessment.
Related tools
You may also find these tools useful.
Redirect Checker
Trace HTTP redirects, inspect 301/302 chains, and verify final destination URLs.
SEO & Webmaster
›
HTTP Headers Parser
Parse raw HTTP headers into JSON and readable key-value pairs.
Network & Web
›
SSL / TLS Certificate Checker
Check certificate validity, expiration, issuer, SANs, OCSP, and TLS details.
Network & Web
›
DNS Lookup / IP & Domain Info
Check DNS records, reverse DNS, and IP/domain details instantly.
Network & Web
›
Robots.txt Tester / Generator
Analyze and generate robots.txt rules online.
SEO & Webmaster
›
Security Headers FAQ
What are security headers?
These are HTTP response headers that a server sends to the browser to enable built-in security mechanisms against common web vulnerabilities.
What does the grade mean?
The grade reflects the implementation level of security best practices. A higher grade means better protection for your users.
Do security headers affect SEO?
Yes. Search engines like Google prioritize secure websites. Headers like HSTS are positive factors.
Is it safe to check my URL here?
Yes. We only analyze your server's public response headers and do not store any data.