HTTP Security Headers Checker

Why HTTP security headers matter

Security headers tell browsers how to handle your site's content. Missing headers - especially CSP and HSTS - are consistently found in penetration tests and listed under OWASP A05: Security Misconfiguration.

Headers we check

• Strict-Transport-Security (HSTS) - Prevents SSL stripping and downgrade attacks
• Content-Security-Policy (CSP) - Primary XSS defense for modern browsers
• X-Frame-Options - Prevents clickjacking by blocking iframe embedding
• X-Content-Type-Options - Stops browsers from MIME-sniffing responses
• Referrer-Policy - Controls how much referrer info is sent with requests
• Permissions-Policy - Controls access to browser APIs (camera, mic, etc.)
• X-XSS-Protection - Legacy header for older browsers