Free security headers check
Security Headers Checker
Security headers tell browsers to stay on HTTPS, refuse to be framed, stop guessing content types and limit what scripts may do. Check which ones your site sends and how they are set.
Check security headers
Enter a page. Its response headers and cookies are read.
Why use the Security Headers Checker
Values, not just presence
HSTS needs a long enough max-age, CSP should not rely on unsafe-inline. The values are checked, not only whether the header exists.
Readable policies
A Content-Security-Policy is split into its directives so you can read it.
Cookie flags
Cookies set by the page are checked for Secure, HttpOnly and SameSite.
Mixed content
http resources loaded by an https page are listed.
When to use the Security Headers Checker
Hardening a site
Get a list of the headers to add, with the reason for each.
Security questionnaires
Answer the header questions with evidence.
CDN migrations
Headers set at the old CDN are easy to lose.
Framework upgrades
Check that the defaults of a new framework still send the headers.
Penetration test prep
Fix the findings every scanner reports before paying for a test.
Third party pages
Check that hosted landing pages and help centres are configured too.
Understanding Security Headers
The headers that matter
- 1Strict-Transport-Security. Tells browsers to use HTTPS only. Use a max-age of at least six months.
- 2Content-Security-Policy. Limits where scripts, styles and frames may come from, the main defence against injected scripts.
- 3X-Content-Type-Options: nosniff. Stops browsers from guessing content types.
- 4Referrer-Policy and framing. Limit what leaks in the Referer header, and stop other sites framing yours with X-Frame-Options or frame-ancestors.
Why the severity is low
Missing headers are hardening, not open doors. They reduce the damage of other bugs. The checker weighs them accordingly, with the exception of mixed content and a broken certificate, which put visitors at real risk.
Deploying a CSP safely
Start with Content-Security-Policy-Report-Only, collect the violations, then enforce. Replace inline scripts with hashes or nonces so you can drop unsafe-inline.
Privacy, safety and limits
The page is requested once by AbackAuditBot. The checker reads the response headers and the Set-Cookie values but never sends them back or stores the cookie values.
Related tools and guides
Frequently asked questions
Which security headers should every site send?
Strict-Transport-Security, X-Content-Type-Options: nosniff, a Referrer-Policy, framing protection and, where you can, a Content-Security-Policy.
Is X-XSS-Protection still needed?
No. Modern browsers removed the feature it controlled. A Content-Security-Policy replaces it.
What max-age should HSTS use?
At least 15552000 seconds, six months. One or two years is common. Add includeSubDomains once every subdomain supports HTTPS.
Why is unsafe-inline flagged?
It allows any inline script to run, which is what an injection attack relies on. Hashes or nonces allow your own inline scripts only.
X-Frame-Options or frame-ancestors?
frame-ancestors in the CSP is the modern way and wins when both are set. Sending both is fine for older browsers.
Where do I set these headers?
In your web server, your CDN or your framework. The security headers generator writes the configuration for Nginx, Apache, Cloudflare, Netlify and Vercel.
Do security headers affect SEO?
Not directly. HTTPS is a light ranking signal and mixed content triggers browser warnings, so they matter to visitors more than to rankings.