Security Headers Checker
Find out which HTTP security headers a site sends, how strong they are and exactly what to add. Every header gets a clear verdict and a copy-ready value, plus config for your server.
Checked live from our server — no signup Free, no limits
How to use the Security Headers Checker
- Enter a website URL (https:// is added if you leave it out).
- Click Scan headers — redirects are followed to the final page.
- Review the grade, score breakdown and each header's verdict, including the CSP directive table and cookie flags.
- Pick your platform under Recommended headers and copy the config into your server or app.
Frequently asked questions
Which security headers matter most?
Content-Security-Policy and Strict-Transport-Security carry the most weight, followed by X-Content-Type-Options, clickjacking protection (X-Frame-Options or CSP frame-ancestors), Referrer-Policy, Permissions-Policy and Cross-Origin-Opener-Policy. Secure cookie flags matter on any site with logins.
Why is 'unsafe-inline' in script-src bad?
It lets any inline <script> run, including one an attacker injects through an XSS bug — which defeats most of what CSP is for. Use a nonce or hash for the inline scripts you need; when either is present, modern browsers ignore 'unsafe-inline'.
What does HSTS preload mean?
Browsers ship with a built-in list of HTTPS-only domains. To be accepted at hstspreload.org you need max-age of at least one year, includeSubDomains, the preload token, and an HTTP-to-HTTPS redirect. Removal from the list takes months, so make sure every subdomain supports HTTPS first.
Should I still send X-XSS-Protection?
No. The XSS Auditor it controlled has been removed from all major browsers, and in some versions it could be abused to leak information. Send X-XSS-Protection: 0 or leave it out, and rely on Content-Security-Policy instead.
Will adding a Content-Security-Policy break my site?
It can, if the policy blocks scripts, styles or fonts you load from other hosts. Deploy it first as Content-Security-Policy-Report-Only, check the browser console or reports for violations, add the hosts you trust, then switch to the enforcing header.
Why does my grade differ from other scanners?
Each scanner weighs headers differently. We score 100 points across HSTS, CSP quality, MIME sniffing, framing, referrer, permissions, COOP, cookie flags and version leaks, and we only see headers on the final page after redirects — not ones set in HTML meta tags.