Free tool · No sign-up
Security Headers Checker
See which useful HTTP response security headers a public page currently sends to browsers.
See the response headers your public page sends.
This check looks at common browser security headers without pretending to replace a security assessment.
How to read the result
What response security headers do
When a browser requests a page, the server can send instructions in HTTP response headers. Several of those headers reduce common browser-side risks, especially on sites that handle forms, accounts or sensitive actions.
This checker looks for headers such as HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. A missing header is not automatically a vulnerability, and adding an aggressive policy without testing can break a site.
Start with the context
HTTPS is the foundation. HSTS can tell browsers to keep using HTTPS, while other headers control framing, content sniffing, referrer information and browser permissions. A sensible policy should match the scripts, payment services, fonts and integrations the website actually uses.
For business websites
Run the check on the public page, note the missing protections and have the hosting or development setup reviewed before changing production headers. Security should make the site safer without quietly breaking the customer journey.