HTTP Security Headers Checker — Test & Score Your Site
Fetch any URL and see which security response headers it sends — Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and Cross-Origin-Opener-Policy. Get a 0–100 security score and targeted fix recommendations for each missing or misconfigured header. Free, no account required.
What are HTTP security headers?
HTTP security headers are HTTP response headers that instruct the browser how to behave when handling your site's content. They are the first line of defense against common web vulnerabilities: XSS, clickjacking, MIME sniffing, protocol downgrade attacks, and cross-origin data leaks.
Unlike TLS certificates or WAF rules, security headers require no infrastructure — just a few lines in your web server or CDN configuration. A missing Content-Security-Policy leaves your users vulnerable to XSS; a missing HSTS header allows protocol downgrade attacks on first load.
Frequently asked questions
- Content-Security-Policy is an HTTP header that tells the browser which sources of content (scripts, styles, images, fonts) are allowed to load on your page. A properly configured CSP prevents cross-site scripting (XSS) attacks by blocking inline scripts and unauthorized script origins. It is widely considered the single most impactful security header.
- HTTP Strict-Transport-Security tells browsers to only connect to your site over HTTPS, even if the user types http://. It prevents protocol downgrade attacks and cookie hijacking on the first visit. Set a long max-age (at least 31536000 seconds / 1 year) and consider adding includeSubDomains and preload for maximum protection.
- X-Frame-Options prevents your page from being embedded in an iframe on another domain, which stops clickjacking attacks where a malicious site overlays an invisible frame of your page to trick users into clicking buttons or links. Modern alternative: Content-Security-Policy's frame-ancestors directive. Use DENY or SAMEORIGIN.
- The score starts at 100 and deducts points for each missing or misconfigured header. Critical headers (CSP, HSTS) deduct more points; important headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy) deduct a medium amount; and additional headers (Permissions-Policy, COOP) deduct a smaller amount. A score of 80+ is considered good; below 50 means critical headers are missing.
Related tools
- → Page Speed Inspector — measure TTFB, DNS, TCP, and TLS timing
- → Redirect Tracer — trace the full redirect chain for any URL
- → Schema Markup Tester — validate JSON-LD, Microdata, and RDFa
Related reading: HTTP Security Headers Explained — 7 Headers That Matter