Security Headers Checker: Does Your Site Send the Right Headers?

Enter a site address to see which security headers it sends and which are missing or weak. Free, instant, no signup.

FreeNo signupNo account or emailLast checked November 2026

A free checker for a website's security headers. Enter a URL and it requests the page and checks Strict-Transport-Security (HSTS), Content-Security-Policy, clickjacking protection, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, with a score and a plain-language fix for each. No signup, no email.

What it checks

  • HSTS, including how long the max-age is
  • Content-Security-Policy, including unsafe-inline and unsafe-eval
  • X-Frame-Options or CSP frame-ancestors
  • X-Content-Type-Options, Referrer-Policy, Permissions-Policy

What you get

  • A score out of 100
  • Each header marked set, weak or missing, with its value
  • What to change for each one

Limits

  • One page per run, after redirects
  • Headers can differ between pages and between a CDN and the origin
  • It checks that headers exist and are sane, not that your policy fits your site
What each header does

Strict-Transport-Security tells browsers to use HTTPS only. Content-Security-Policy lists where scripts and other resources may load from. X-Frame-Options or frame-ancestors stops other sites embedding yours. X-Content-Type-Options: nosniff stops browsers guessing file types. Referrer-Policy and Permissions-Policy limit what the page shares and which browser features it may use.

Adding a strict Content-Security-Policy can break a site, so start with a Report-Only policy and tighten it from the reports.

Frequently asked questions

How do I check a website's security headers?

Enter the site's address above. The tool requests the page, reads the response headers, and rates each security header as set, weak or missing, with a score out of 100.

Which security headers matter most?

HSTS and Content-Security-Policy carry the most weight, because they stop downgrade attacks and cross-site scripting. Clickjacking protection and X-Content-Type-Options are quick wins, and Referrer-Policy and Permissions-Policy limit what the browser shares.

Do security headers affect SEO?

Not directly as a ranking factor. HTTPS is a light Google signal, and HSTS keeps visitors on HTTPS. The larger reason to set them is that a hacked site loses rankings fast.

Related tools

Cloudflare DetectorNameserver LookupGzip and Brotli Compression CheckerMX Record Lookup

We use cookies to analyze site usage and improve your experience. You can decline non-essential cookies. Privacy Policy