Security Headers Checker
Analyze any website's HTTP security headers and get a detailed grade with actionable recommendations.
Analyzing security headers...
What Are Security Headers?
HTTP security headers are directives sent by a web server to the browser that dictate how the browser should handle the site's content. They are a critical layer of defense against common web attacks like cross-site scripting (XSS), clickjacking, and data injection.
Headers We Check
Content-Security-Policy (CSP)
Controls which resources the browser can load, preventing XSS and data injection attacks. A strong CSP is the single most impactful security header.
Strict-Transport-Security (HSTS)
Forces browsers to always use HTTPS, preventing SSL stripping and man-in-the-middle attacks. Should include a max-age of at least one year.
X-Frame-Options
Prevents your pages from being embedded in iframes on other sites, protecting against clickjacking attacks.
X-Content-Type-Options
Stops browsers from MIME-type sniffing, preventing attacks where malicious files are disguised as harmless content types.
Referrer-Policy
Controls how much referrer information is sent with requests, protecting user privacy and preventing URL-based data leakage.
Permissions-Policy
Restricts access to browser features like camera, microphone, and geolocation. Limits the attack surface for malicious scripts.
Learn more: Cross-Site Scripting (XSS) · Clickjacking · Man-in-the-Middle Attacks