Security Header Checker
Check which HTTP security headers a public URL sends, and get plain-language notes on each. Reuses the same SSRF-safe fetch as the HTTP Header Checker.
Your input is used for this one lookup only. It is not logged or stored.
Results
How to read the results
Each header shows a status: Present, Missing, Weak (present but with a risky setting such as unsafe-inline or a wildcard), Informational, or Not applicable. The count is a configuration summary, not a security grade.
Not a certification
A high count does not certify a site as safe, and a low count does not mean it is unsafe. Use this as a checklist alongside a full security review.
Data source: Server-side fetch. Only response headers are inspected; the body is not downloaded. Learn about our data sources →
Read more
- HTTP security headers: which ones matter and what to set them to — What each header actually defends against, a starting value for each, and how to ship a CSP without taking your own site down.
Frequently asked questions
Does a full score mean my site is secure?
No. These headers are one layer of defense. A site can have every header and still be vulnerable, or lack some headers and still be well protected. Treat this as a configuration checklist, not a security certification.
Why is X-XSS-Protection marked informational?
Modern browsers ignore it, and it could even cause issues historically. Its absence is fine; a strong Content-Security-Policy is the current recommendation.
Could adding these headers break my site?
Yes — an overly strict CSP or CORP/COEP can block legitimate resources. Test changes carefully in staging.