Free security headers checker

What does this checker look at?

Security headers are short instructions your website sends to the browser along with every page. Visitors never see them, but they turn on browser protections against attacks like clickjacking and injected code.

When you enter your domain, the checker loads your homepage the way a browser would and reads the response headers. It looks for six:

• Strict-Transport-Security (HSTS): tells browsers to always use HTTPS for your site. We check that max-age is at least six months.
• Content-Security-Policy (CSP): limits where scripts, styles and other resources can load from, which helps guard against injected code.
• X-Content-Type-Options: set to nosniff, it stops browsers guessing a file's type and treating it as something more dangerous.
• Clickjacking protection: either X-Frame-Options set to DENY or SAMEORIGIN, or a CSP frame-ancestors rule. This stops other sites secretly embedding your pages.
• Referrer-Policy: controls how much of your page address is shared when visitors click a link to another site.
• Permissions-Policy: turns off parts of the browser your site doesn't use, like the camera, microphone or location.

How do I read my results?

Configured means all six headers are present with acceptable values. You don't need to do anything else.

Partially configured means between two and five headers are in place. Your site has some protection, and adding the rest is usually a short job. The result lists which headers are missing or weak.

Needs attention means fewer than two of the six headers are in place. That's common, especially on sites that have never been configured for this, and it's quick to improve.

A header can be present and still count as weak. Here's what we look for:

• HSTS with a max-age shorter than six months is listed as weak.
• X-Content-Type-Options only counts when it's set to nosniff.
• X-Frame-Options only counts when it's DENY or SAMEORIGIN. A CSP frame-ancestors rule also counts.
• Referrer-Policy set to unsafe-url doesn't count, because it shares full page addresses with every site you link to.
• CSP and Permissions-Policy count whenever they're present.

If you see Couldn't check, we couldn't load your homepage. Check that the address is right and the site is online, then try again.

How do I fix common problems?

Security headers are server settings, so where you add them depends on how your site is hosted. These values are safe defaults for most small business websites:

• In Cloudflare, add each header with a Response Header Transform Rule that applies to all requests.
• On WordPress, ask your host whether they can add headers in their control panel. If not, a reputable headers plugin can do it. Our WordPress security checklist covers this alongside other hardening steps.
• On Apache or Nginx, add the headers to your .htaccess file or server block, then reload.
• Squarespace, Wix and Shopify manage headers for you, so contact their support about anything missing.

Only add HSTS once HTTPS works on every page of your site, including subdomains if you use includeSubDomains. You can confirm your certificate with the free SSL checker. After adding headers, click around your site, especially forms, embedded videos and checkout, then run this checker again.

For a broader look at protecting your site, see our guide to website security.

Is this check safe to run?

Yes. The checker makes an ordinary request for your homepage, the same as any visitor's browser, and reads the headers your server already sends. It doesn't log in, submit forms, scan ports or change anything on your site.

Nothing is installed, and you don't need to sign in. Single-check tools like this one don't store the domains you look up. For a saved report that covers headers alongside your certificate and email setup, run the free website security scan.