Security headers checker
Test your site for missing HTTP security headers in seconds. Paste your URL and we read your response headers from the outside, flag the ones you're missing, and the full report shows the exact line to add for each. Free, no signup.
Check your security headers
Enter your site's URL. We check for CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy — as part of a full free scan.
Only scan sites you own or have permission for.What are security headers?
Every time someone visits your site, your server sends back a set of HTTP response headers alongside the page. A handful of these are security headers — instructions that tell the browser how to protect your visitors: which sources are allowed to run scripts, whether your site can be embedded in a frame, and to only ever connect over HTTPS. They don't fix bugs in your code, but they close off entire classes of common attacks like cross-site scripting and clickjacking. Most AI-built and quickly-shipped apps go live without them.
The security headers we check
| Header | What it does | Risk if missing |
|---|---|---|
| Content-Security-Policy | Controls which sources may load scripts, styles and other content. | Weaker defence against cross-site scripting (XSS) and injection. |
| Strict-Transport-Security | Forces browsers to use HTTPS for every future request (HSTS). | Users can be downgraded to insecure HTTP and intercepted. |
| X-Frame-Options | Stops your site being embedded in an iframe on another site. | Clickjacking — tricking users into clicking hidden elements. |
| X-Content-Type-Options | Stops the browser from guessing (sniffing) a file's type. | Files can be interpreted as a dangerous type (e.g. script). |
| Referrer-Policy | Controls how much URL information is sent to other sites. | Leaking sensitive paths or tokens through the referrer. |
| Permissions-Policy | Limits access to browser features like camera, mic and location. | Embedded or injected content can request powerful features. |
How the check works
The checker reads your site's live response headers from the outside — the same way a browser does — and reports which of the six security headers are present and which are missing. It's passive and read-only: we never log in, never change anything, and only look at what your server already sends to every visitor. Missing headers are flagged as hardening items (not emergencies), and the full report gives you the exact header line to add to your host or framework config.
Missing headers are worth fixing, but they're hardening, not an open door. If you're checking your headers, it's worth running the full scan too — it also checks the things that actually leak data, like an open Supabase database or leaked API keys.
See which headers your site is missing
Free, no signup, results in about 10 seconds.
Only scan sites you own or have permission for.How to fix missing headers
Security headers are set once, in one place — your web server or framework — and apply to every page. The exact syntax depends on your stack (nginx add_header, an Express/Helmet middleware, a Netlify/Vercel config file, etc.), but the goal is the same: send all six with sensible values. Start with the two that matter most — a Content-Security-Policy and Strict-Transport-Security — then add the rest. The full report lists each missing header with a ready-to-paste value for your setup.