Free Security Tool

HTTP Security Header Checker

Instantly analyze your website's security headers. The grade is free. A work email unlocks the specific fix for each gap.

What HTTP security headers are and why they matter

HTTP security headers are directives your web server sends with every response to tell the browser how to handle your site safely. They are the cheapest defence you can add against cross-site scripting (XSS), clickjacking, MIME sniffing, and protocol downgrade attacks. Running an HTTP header check is the fastest way to see which of these protections are present, because a missing header is one of the most common and easiest to fix issues on the web.

Which security headers this checker tests

  • Strict-Transport-Security (HSTS): forces HTTPS and blocks downgrade attacks.
  • Content-Security-Policy (CSP): controls which scripts and resources may load, the strongest browser side defence against XSS.
  • X-Content-Type-Options: stops the browser from MIME sniffing a response into an unexpected type.
  • X-Frame-Options: prevents your pages from being framed, which defeats clickjacking.
  • Referrer-Policy and Permissions-Policy: limit referrer leakage and restrict access to browser features such as camera and geo.

How to add security headers to your website

Security headers are set by your web server or framework. In Nginx you use add_header directives, in Apache you use Header set, in Next.js you configure them in next.config.js or middleware, and in Express the helmet package sets a sensible baseline in one line. Start with HSTS and a report only Content-Security-Policy, then tighten the policy as you confirm nothing legitimate is blocked.

For a full walkthrough with copy ready configuration snippets, read our guide on how to check your website's security headers. When you are ready to see how your headers map to audit controls, a free External Security Check shows how your configuration lines up with the Essential Eight, SOC 2, and ISO 27001 controls it touches.

Frequently asked questions

What security headers should every website have?

Every site should send Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy. Together they defend against XSS, clickjacking, MIME sniffing, and downgrade attacks.

How do I check my HTTP security headers?

Enter your URL above and this tool reads the response headers and grades them from A to F with a fix for each gap. You can also inspect them manually in your browser developer tools under the Network tab.

How do I add security headers to my website?

Set them at the web server or framework level. Use add_header in Nginx, Header set in Apache, middleware in Next.js, or the helmet package in Express.

What is Content-Security-Policy?

Content-Security-Policy is an HTTP header that controls which resources, such as scripts, styles, and images, a browser may load on your page. It is the most effective browser side defence against XSS.

What is HSTS?

HTTP Strict-Transport-Security tells browsers to only ever connect to your site over HTTPS. It prevents downgrade attacks and stops a first insecure request from being intercepted.