Security Headers Checker

What are HTTP security headers?

Every time a browser loads a page, the server sends a set of response headers before the HTML. A handful of those headers tell the browser how strictly to treat the page: whether to always use HTTPS, which scripts are allowed to run, and whether other sites may load it inside a frame.

They cost nothing to add, they do not change how your site looks, and they close off whole classes of attack such as clickjacking, protocol downgrades and many cross-site scripting tricks. They are also one of the first things penetration testers and cyber insurance questionnaires look at.

The headers this tool checks

These are the headers most security scanners and hardening guides expect to see, with a sensible starting value for each:

• Strict-Transport-Security: max-age=31536000; includeSubDomains. Forces HTTPS for a year so connections cannot be downgraded.
• Content-Security-Policy: start with default-src 'self' and add the domains you actually load from. The strongest defence against injected scripts.
• X-Frame-Options: SAMEORIGIN. Stops other sites putting your pages in an invisible iframe (clickjacking). CSP frame-ancestors does the same job.
• X-Content-Type-Options: nosniff. Stops browsers guessing file types, which blocks some script injection routes.
• Referrer-Policy: strict-origin-when-cross-origin. Stops full URLs, including any tokens in them, leaking to other sites.
• Permissions-Policy: camera=(), microphone=(), geolocation=(). Switches off browser features you do not use.

How to add security headers

Where you add them depends on your hosting. On Netlify use a _headers file or netlify.toml. On Vercel use the headers section of vercel.json. On Nginx use add_header in the server block, on Apache use Header always set in .htaccess, and on Cloudflare use a Transform Rule to modify response headers. WordPress sites can use a security plugin or the host's control panel.

Add Content-Security-Policy last and test it carefully. A strict policy can block analytics, chat widgets or embedded videos. Send it as Content-Security-Policy-Report-Only first, watch for violations, then switch it on.