Free tool
What security headers does your site send?
Paste your address. We request your home page over https, live, right now, and report which of six security headers it sends, with the value of each. No email, no account, no score.
Takes a few seconds · checks only sites you own or are authorized to test · the address you check is not kept
What this checks
Your home page, requested over https, live, right now, following any redirect the same way a browser would. We also request the plain http address once to see whether it redirects to https. For the https response we read six headers, each reported present with its value, absent, or could not be read. There is no score and no letter grade here: this reports what your server actually sent.
What each header asks a browser to do
Strict-Transport-Security tells the browser to use https for this site, without asking again, for a length of time the header states.
Content-Security-Policy tells the browser which sources of scripts, styles and other content the page is allowed to load from. Its report-only form, Content-Security-Policy-Report-Only, asks the browser to report what it would have blocked without actually blocking anything, so this tool names it report-only rather than counting it as enforcement.
X-Content-Type-Options tells the browser to trust the content type the server declared for a file rather than guessing one from its contents.
Referrer-Policy tells the browser how much of your page's address to pass along when a visitor follows a link to another site.
X-Frame-Options, or a frame-ancestors rule inside Content-Security-Policy, tells the browser which sites, if any, are allowed to show your page inside a frame on theirs.
Permissions-Policy tells the browser which device features, such as the camera or location, your page is allowed to ask for.
Related reading
For the fuller picture of how these and other signals add up, see the free scan, which reads your whole home page rather than one set of headers.
Questions about this check
What does this check actually do? It requests your home page over https, live, right now, following any redirect by hand, and reads six response headers plus the report-only form of one of them. Each is reported present with its value, absent, or could not be read. There is no score and no letter grade: this reports what your server sent.
What does this not check? It does not check any page besides the home page, and it does not say whether a header’s value is configured correctly for your site, only whether it is present and what it says. A Content-Security-Policy-Report-Only header is reported as report-only, never counted as enforcement, because the browser does not enforce it.
What do I do if a header is missing? Add it at your server, CDN or hosting platform’s header configuration. Each header above links to one plain sentence explaining what it asks a browser to do, which is the starting point for deciding what value to set.