Free tool
Check a site's security headers
Enter a website and we'll fetch its HTTP response headers, grade the security ones, and explain in plain language what each does and what's missing.
How this works
- We make a single request to the address from our server and read only the response headers.
- We don't store the result, and nothing is shared unless you copy the link.
Frequently asked questions
What are HTTP security headers?
Response headers like HSTS and Content-Security-Policy that tell browsers to enforce safer behaviour - blocking downgrade attacks, cross-site scripting, and clickjacking.
Which security headers should a website have?
At minimum HSTS, Content-Security-Policy, X-Content-Type-Options, a framing protection (X-Frame-Options or CSP frame-ancestors), Referrer-Policy, and Permissions-Policy.
My website will not load - how do I find out why?
Check four layers in order and stop at the first failure: does the domain still resolve, does anything answer at that address, does the secure connection work, and what status code does the server actually return. Do not rely on a ping - if your site sits behind Cloudflare or a similar service, their edge answers even when your own server is dead.