HTTP Security Header Checker
Instantly analyze your website's security headers. The grade is free. A work email unlocks the specific fix for each gap.
Instantly analyze your website's security headers. The grade is free. A work email unlocks the specific fix for each gap.
HTTP security headers are directives your web server sends with every response to tell the browser how to handle your site safely. They are the cheapest defence you can add against cross-site scripting (XSS), clickjacking, MIME sniffing, and protocol downgrade attacks. Running an HTTP header check is the fastest way to see which of these protections are present, because a missing header is one of the most common and easiest to fix issues on the web.
Security headers are set by your web server or framework. In Nginx you use add_header directives, in Apache you use Header set, in Next.js you configure them in next.config.js or middleware, and in Express the helmet package sets a sensible baseline in one line. Start with HSTS and a report only Content-Security-Policy, then tighten the policy as you confirm nothing legitimate is blocked.
For a full walkthrough with copy ready configuration snippets, read our guide on how to check your website's security headers. When you are ready to see how your headers map to audit controls, a free External Security Check shows how your configuration lines up with the Essential Eight, SOC 2, and ISO 27001 controls it touches.
Every site should send Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy. Together they defend against XSS, clickjacking, MIME sniffing, and downgrade attacks.
Enter your URL above and this tool reads the response headers and grades them from A to F with a fix for each gap. You can also inspect them manually in your browser developer tools under the Network tab.
Set them at the web server or framework level. Use add_header in Nginx, Header set in Apache, middleware in Next.js, or the helmet package in Express.
Content-Security-Policy is an HTTP header that controls which resources, such as scripts, styles, and images, a browser may load on your page. It is the most effective browser side defence against XSS.
HTTP Strict-Transport-Security tells browsers to only ever connect to your site over HTTPS. It prevents downgrade attacks and stops a first insecure request from being intercepted.