Security Headers Checker
Analyze your website's HTTP security headers — CSP, HSTS, X-Frame-Options, and more.
🔒 No cookies, no tracking except a page visit count. URLs are fetched server-side — never stored.
About this tool
This free security headers checker evaluates your website's HTTP response headers against industry best practices. It checks for critical security headers defined by OWASP, the Mozilla Observatory, and securityheader.com standards. Each header receives a pass/fail status, and you get a letter grade (A–F) for your overall security posture.
The test is performed server-side — we fetch your URL from Cloudflare's edge network and analyze the response headers. Your URL is not stored, logged, or shared. 100% free, no signup required.
What each critical header does
- Content-Security-Policy (CSP) — Controls which resources (scripts, styles, images) the browser can load. Reduces XSS risk dramatically.
- Strict-Transport-Security (HSTS) — Forces HTTPS connections. Prevents downgrade attacks and cookie hijacking.
- X-Frame-Options — Prevents clickjacking by controlling whether your page can be embedded in frames.
- X-Content-Type-Options — Prevents MIME-type sniffing. Set to
nosnifffor protection. - Referrer-Policy — Controls how much referrer information is sent with requests. Recommended:
strict-origin-when-cross-origin. - Permissions-Policy — Controls which browser features (camera, microphone, geolocation) your site can access.