Security headers checker
Check your website's HTTP security headers for free: CSP, HSTS, X-Frame-Options, Referrer-Policy and more, with plain-English fixes.
Free, no sign-up. One normal request, like a browser makes; nothing is attacked.
What are HTTP security headers?
Every time someone opens a page, your server sends headers along with it. Some of them tell the browser how to protect your visitors: only use HTTPS, don't let other sites frame this page, don't guess file types, and so on. They cost nothing to add and are one of the first things security scanners check.
The headers we check
Strict-Transport-Security
Tells browsers to use HTTPS only for your site, so later visits can't be downgraded to plain HTTP.
Content-Security-Policy
Limits where scripts, styles and frames may load from, which reduces the damage of injected code (XSS).
X-Frame-Options
Stops other sites from showing your pages inside a frame (clickjacking). CSP frame-ancestors does the same in newer browsers.
X-Content-Type-Options
Stops browsers from guessing file types, so an upload can't be run as a script.
Referrer-Policy
Controls how much of your page address is passed to other sites when visitors click a link.
Permissions-Policy
Turns off browser features your site doesn't use (camera, microphone, location).
Cross-Origin-Opener-Policy
Keeps your pages in their own browsing group, away from windows opened by other sites. Optional; test sign-in and payment pop-ups.
Cross-Origin-Resource-Policy
Tells browsers which sites may load your files. Optional; don't set it if other sites embed your images or files.
We also flag Server and X-Powered-By headers that show version numbers, and the Secure, HttpOnly and SameSite flags on cookies set by the page.
How to add security headers
- Nginx:
add_header Name "value" always;in the server block, then reload Nginx. - Apache / LiteSpeed:
Header always set Name "value"in .htaccess or the virtual host (mod_headers). - Cloudflare: Rules › Transform Rules › Modify Response Header.
- WordPress: the .htaccess lines on Apache/LiteSpeed hosts, or a headers plugin.
Run a check above and the result shows copy-paste lines for exactly the headers your site is missing.
Headers vs a full security scan
Headers are only one part. The free Safe Scan also checks TLS, cookies, exposed common files, SPF/DMARC and recent critical CVEs. The Deep / Active Scan (US$45 one-off) is an ownership-verified active scan with a fix-first report; Security Care (US$35 a month) keeps watching. See current threats, a sample report, or check your email records next.
FAQ
What are security headers?
Instructions your server sends with each page that tell browsers how to handle it safely, for example only over HTTPS (HSTS) or not inside other sites' frames.
Which headers matter most?
HSTS, Content-Security-Policy, X-Content-Type-Options, a framing control (X-Frame-Options or CSP frame-ancestors) and Referrer-Policy.
What does "http security headers not implemented" mean?
A scanner found one or more of these headers missing. The table shows which ones and how to add them.
Will adding a CSP break my site?
It can if it is too strict. Start with Content-Security-Policy-Report-Only and test.
Does a good header result mean my site is secure?
No. Headers are one layer. The Safe Scan and Deep Scan look further, and even they don't replace a human pentest.
Is this scan safe to run?
Yes. It makes one normal request, like a browser does, plus a check of the http-to-https redirect.
Is it free?
Yes, no sign-up.