Security Headers Checker
Check a website's HTTP security headers and get a grade from A+ to F. See which of HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy are set. Try https://example.com.
- Free
- No signup required
- Live header check
Common security header problems
No Strict-Transport-Security (HSTS)
Without HSTS, a visitor who types your domain without https makes the first request over plain HTTP, which can be intercepted. Add Strict-Transport-Security with a long max-age once every subdomain you include works over HTTPS.
No Content-Security-Policy
CSP limits where scripts, styles and frames may load from, which reduces the damage of a cross-site scripting bug. Start with Content-Security-Policy-Report-Only to see what would break, then enforce.
Page can be framed by any site
Without X-Frame-Options or a CSP frame-ancestors directive, another site can load your pages in an iframe and trick users into clicking (clickjacking). Set frame-ancestors 'self', or X-Frame-Options: SAMEORIGIN for older browsers.
Missing X-Content-Type-Options
Without nosniff, some browsers guess a file's type from its content, so an uploaded file can be run as a script. Add X-Content-Type-Options: nosniff to every response.
Server and framework versions exposed
Headers like Server: Apache/2.4.41 or X-Powered-By: PHP/7.4 tell attackers which known bugs to try. Turn them off (server_tokens off in nginx, expose_php = Off in PHP).
Headers set on some responses only
A CDN, proxy or framework may add headers to pages but not to redirects, error pages or static files. Check the final URL and a few other paths, and set headers at the outermost layer you control.
How to check security headers
- Enter the URL of the page to test, for example https://example.com.
- Click Check headers.
- Read the grade, then each header marked missing or weak.
- Add the missing headers on your server, CDN or framework, then check again.
What are HTTP security headers?
Security headers are response headers that tell the browser to turn on protections for your site. They cost nothing to send and close off whole classes of attack, such as downgrading to HTTP, clickjacking and content-type sniffing.
Strict-Transport-Security makes the browser use HTTPS only. Content-Security-Policy restricts where scripts and other resources may load from. X-Frame-Options, or CSP frame-ancestors, controls who may embed your pages. X-Content-Type-Options: nosniff stops type guessing. Referrer-Policy limits how much of your URLs leaks to other sites. Permissions-Policy turns off browser features such as the camera or geolocation for pages that do not need them.
The grade reflects which of these are present and set sensibly. It is a check of headers only, not a penetration test or vulnerability scan: a site can score A+ and still have bugs in its code.
Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: default-src 'self'; frame-ancestors 'self' X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Permissions-Policy: camera=(), microphone=(), geolocation=()
When to use a security headers checker
Before a security review or questionnaire
Customers and auditors often ask about HSTS and CSP. Check what you actually send before you answer.
Hardening nginx or Apache
After adding add_header or Header set lines, confirm they reach the browser and apply to every response, including redirects.
Sites behind Cloudflare or Vercel
Check whether headers come from your origin, the CDN or both, and that a Transform Rule or vercel.json config is really applied.
WordPress and Shopify stores
See which headers your host or theme already sets before installing a plugin that may add duplicates.
Check something else
- SSL CheckerCheck a site's SSL certificate, expiry date and whether the intermediate certificate is installed.
- TLS Version CheckerSee which TLS versions a server accepts, from TLS 1.0 to TLS 1.3, and the cipher it picks for each.
- Redirect CheckerTrace every redirect hop of a URL with status code, Location and time, and spot loops and long chains.
- HTTP Status Code CheckerCheck the HTTP status code any URL returns, with response time and every redirect on the way.
Frequently asked questions
Is this a security scan?
No. It reads the response headers of one URL and grades them. It does not test for vulnerabilities, try to log in or probe your server. It is not a penetration test.
What does the A+ grade need?
All the main headers present and set to strong values, including HSTS with a long max-age and a Content-Security-Policy. Missing headers lower the grade, and version leaks in Server or X-Powered-By are noted.
Should I use X-Frame-Options or CSP frame-ancestors?
frame-ancestors is the modern way and is more flexible. X-Frame-Options still helps older browsers. Sending both with the same intent is fine.
Is X-XSS-Protection still needed?
No. Modern browsers removed the XSS filter it controlled. A Content-Security-Policy is the replacement.
What max-age should HSTS use?
Start short (for example 300 seconds) while testing, then raise it. The HSTS preload list requires at least one year (31536000 seconds), includeSubDomains and the preload directive.
Why does my CSP break the site?
Inline scripts, analytics tags and third-party widgets need to be allowed explicitly. Use Content-Security-Policy-Report-Only first and fix what it reports before enforcing.
Secure is good. Up is essential.
Headers protect visitors once they reach the site. TinyPing makes sure they can, checking every 5, 15 or 30 minutes and alerting you when:
- the site returns an error or times out
- an expired certificate breaks HTTPS
- the domain stops resolving
US$6.99 a month or US$47 a year per 50 monitors, team members free. 7-day free trial, no card needed.
Want alerts in team chat? Follow the guide for Slack or Google Chat.