HTTP Security Headers Checker

What HTTP security headers do

Security headers are instructions a server sends with every response, telling the browser what it is and is not allowed to do with the page. They cost nothing to add and they are enforced by the browser itself, which makes them among the cheapest defences available — and among the most commonly missing.

None of them fix a vulnerability in your application. What they do is limit the damage when one exists: a Content-Security-Policy turns an injected script into a blocked request, and HSTS turns a downgrade attack into a failed connection.

The headers that matter

Content-Security-Policy is the hard one

CSP is the most powerful header and the only one that reliably breaks a working site when misconfigured. It works by listing the sources a page may load from; anything not listed is blocked. That is exactly the point, and exactly the problem — inline scripts, analytics, fonts and embedded widgets all have to be accounted for.

Deploy it in report-only mode first. The browser reports what would have been blocked without blocking it, so you can fix the policy against real traffic rather than guessing:

Once the reports are quiet, switch the header name to Content-Security-Policy and it starts enforcing.

A note on 'unsafe-inline': it is common, and it removes most of CSP's protection against cross-site scripting, because an injected inline script is indistinguishable from one you wrote. Nonces or hashes are the alternative. Many sites ship 'unsafe-inline' permanently and still benefit from the rest of the policy — but it is a compromise, not a default worth keeping quietly.

HSTS and the preload list

Strict-Transport-Security tells the browser to refuse plain HTTP for your domain for the duration of max-age. It closes the window where a first request over HTTP can be intercepted before the redirect to HTTPS.

Adding preload submits your domain to a list compiled into browsers, so even a first-ever visit is protected. Two things to understand before you do it:

• Preload requires includeSubDomains. Every subdomain must serve valid HTTPS — including internal ones you may have forgotten about.
• Removal is slow. Getting off the preload list takes months to reach users, so treat it as a commitment rather than a setting.

X-Frame-Options vs frame-ancestors

Both stop your pages being framed. X-Frame-Options is the older header; frame-ancestors is the CSP directive that replaced it and is the one modern browsers honour when both are present.

Send both. X-Frame-Options: DENY covers older clients, frame-ancestors 'none' covers current ones, and they cost a few bytes:

If you legitimately need to be embedded, list the permitted origins in frame-ancestors rather than dropping the protection entirely.

How to check your security headers

Enter a URL in the checker above for a graded report. To inspect them yourself:

Headers are set wherever your responses originate — the web server config, the CDN, or the hosting platform. Check the layer closest to the user first: a CDN can add or strip headers your origin thinks it is sending.

Common mistakes

Related checks

• SSL/TLS inspector — certificate chain, expiry and protocol support.
• SPF checker — which servers may send email as your domain.
• Email deliverability audit — SPF, DKIM, DMARC, MX and SSL in one scored report.