What are security headers?

Security headers are HTTP response headers that tell browsers how to handle transport security, script execution, framing, MIME sniffing, referrer data, feature access and cross-origin isolation.

Does every website need the same security headers?

No. Header values should match the website architecture, third-party scripts, embedded content and user workflows. The checker highlights common browser security controls that are usually reviewed in production.

Can this tool check private URLs?

No. Private, loopback, local, multicast and reserved address ranges are blocked. Use local tools for intranet or internal applications.

HTTP protocol tools

Security Headers Checker

Check the browser security headers returned by any public website. Review HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP, CORP, cookies, cache behavior, and server disclosure.

Security scorecardGrade common browser protection headers with weighted checks.

Actionable findingsSee which controls pass and which need configuration review.

Raw headers includedInspect exact response values after the focused security summary.

Security Headers Checker: Working tool

Enter a public website URL or domain. The checker fetches the live response headers and scores the security controls visible to browsers.

Security score

Weighted score based on transport, content, framing, MIME, referrer, feature, and cross-origin policy headers.

Header checklist

Each card shows the detected value and the points earned for that browser protection.

Review notes

Passed controls, missing controls, and extra signals that deserve a closer look.

Raw response headers

Exact response headers returned by the final public URL.

Header	Value

Security Headers Checker: Short intro

Security headers are HTTP response headers that give browsers rules for safer behavior. They can force HTTPS, limit script and content sources, reduce clickjacking risk, prevent MIME sniffing, control referrer leakage, restrict powerful browser APIs, and isolate cross-origin resources.

This checker gives a fast first look at the headers users actually receive from the public URL, including headers added or removed by CDNs, reverse proxies, WAFs, load balancers, and application servers.

Security Headers Checker: Example input/output

Example input

Enter a domain or full URL.

https://example.com

Example output

The result can show a grade, score, passed checks, and missing headers.

Grade: B
Score: 78%
Passed: HSTS, X-Content-Type-Options, Referrer-Policy

Header values

Detected values are shown so you can verify exact policy strings.

strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: default-src 'self'

Security Headers Checker: Common errors

Missing HSTS: HTTPS may work, but browsers are not being told to keep using HTTPS for future visits.
Weak or absent CSP: script, frame, image, object, or base URI behavior may be too broad for production.
Clickjacking control missing: add X-Frame-Options or CSP frame-ancestors where framing is not required.
Private address blocked: internal, loopback, local, multicast, and reserved IP ranges are not accepted.
Different CDN behavior: one URL path, hostname, or redirect target may return different headers than another.
HEAD blocked: switch to GET if the website blocks HEAD or returns a different header set for HEAD.

Security Headers Checker: Use cases

Pre-launch review

Check public production headers before a website, portal, API documentation site, or customer dashboard goes live.

After CDN changes

Verify whether your CDN, WAF, or reverse proxy still forwards HSTS, CSP, referrer, and permissions policies.

Security hardening

Build a prioritized list of missing browser protections and compare changes after each deployment.

Clickjacking checks

Confirm whether framing is denied, same-origin only, or controlled through CSP frame-ancestors.

Cookie review support

Use Set-Cookie visibility as a prompt to review Secure, HttpOnly, SameSite, Path, and Domain attributes.

Change validation

Run a quick public check after web server, Nginx, Apache, Cloudflare, load balancer, or application config updates.

Security Headers Checker: FAQ

Does a high score guarantee security?

No. Headers are one layer. You still need secure code, authentication controls, dependency hygiene, patching, monitoring, and testing.

Can CSP break a website?

Yes. CSP should be tested carefully because it can block scripts, fonts, images, frames, and API calls if the policy is too strict.

Is X-Frame-Options still needed?

CSP frame-ancestors is more flexible, but X-Frame-Options is still commonly used for broad compatibility.

Why is HSTS missing on HTTP?

Browsers only honor HSTS over HTTPS. Check the final HTTPS URL and confirm redirects are working correctly.

Why do results differ by URL path?

Different paths may be served by different apps, caches, CDNs, or rules. Test the exact URL users visit.

Can it check internal apps?

No. The public checker blocks private address ranges. Use local browser tools, curl, or a scanner inside your network.

Security Headers Checker: Related tools

HTTP Header Checker for a general response header table, status, redirects, cache, cookies, and server details.
SSL Checker for HTTPS certificate validity, issuer, expiry, trust chain, and TLS details.
Certificate Checker for decoding pasted PEM certificates and certificate chains.
Certificate Chain Composer for fetching missing intermediate certificates.
DNS Lookup for checking public DNS records that influence where the website is served from.