Security Headers Checker
Analyze all HTTP security headers for any website. See what is missing and what needs improvement — with actionable remediation guidance.
Advertisement
Headers Analyzed
Content-Security-Policy
Prevents XSS, data injection, and other code injection attacks by controlling allowed content sources.
Strict-Transport-Security (HSTS)
Forces browsers to use HTTPS, preventing downgrade attacks and cookie hijacking.
X-Frame-Options
Controls whether browsers can render the page in frames, preventing clickjacking attacks.
X-Content-Type-Options
Prevents MIME-type sniffing, reducing the risk of drive-by download attacks.
Referrer-Policy
Controls how much referrer information is included with requests, protecting user privacy.
Permissions-Policy
Controls which browser features and APIs can be used, limiting attack surface.