HTTP Security Headers Checker
Free HTTP security headers checker. See whether a site sends HSTS, CSP, X-Frame-Options, and the other browser-enforced security headers, and what's missing. No account needed.
3 free checks per day. No signup needed.
What gets checked
This tool makes a real request to the site and reads six response headers: HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. Each protects against a different class of attack, and this shows exactly which ones a site sends today, not a generic pass/fail grade.
How to check a website's security headers
- 1Enter the site's URL and run the check.
- 2We request the page and read the security-related headers the server sends back.
- 3You see which headers are present and which are missing, so you know what to add.
The key security headers
Each header closes a specific gap. HSTS forces HTTPS, Content-Security-Policy limits which scripts can run, X-Frame-Options blocks clickjacking, X-Content-Type-Options stops MIME sniffing, and Referrer-Policy and Permissions-Policy limit what the browser leaks and what page features are allowed.
What a missing header exposes
A missing header is not hypothetical. Without HSTS a visitor can be pushed back to plain HTTP; without X-Frame-Options your page can be framed inside a hostile site; without a Content-Security-Policy an injected script runs with far fewer limits. The fix is usually a few lines in your server or CDN configuration.
Frequently asked
What are HTTP security headers?
Response headers a server sends to instruct the browser to enforce extra protections: forcing HTTPS, restricting script sources, blocking framing, and more. None are enabled by default.
Do I need all of these headers?
It depends on the site's risk profile. Content-Security-Policy in particular needs care, a policy that's too strict can break legitimate scripts or embeds if it's not tested against the actual page.
How do I check a website's security headers?
Enter the URL above and run the check. This security headers checker requests the page and reads the security-related response headers, then shows which are present and which are missing so you know exactly what to add.
Which security headers matter most?
HSTS (to force HTTPS), Content-Security-Policy (to limit scripts), and X-Frame-Options (to stop clickjacking) are the highest-impact for most sites. X-Content-Type-Options, Referrer-Policy, and Permissions-Policy are quick, low-risk additions on top.
Can I add these headers myself?
Yes. Security headers are set in your web server, framework, or CDN configuration, usually a few lines. Add them, then re-run this check to confirm they are being sent correctly on the live site.
Related tools: SSL Certificate Checker ·DNS Lookup
Headers are one snapshot of a site's health.
Expiroo watches the parts of a site that change over time, uptime, SSL certificate expiry, DNS, and domain expiration, and alerts you by email, Telegram, WhatsApp, or webhook before any of them break.
Start monitoring for freeNo charge during your 7-day trial.