Free HTTP Header Checker

HTTP security headers are response headers that instruct browsers on how to handle your site content. They protect against common attacks like XSS (cross-site scripting), clickjacking, MIME sniffing, and man-in-the-middle attacks. Missing security headers are a frequent cause of web application vulnerabilities.

HSTS tells browsers to always connect to your site over HTTPS, even if users type "http://". This prevents SSL stripping attacks where an attacker downgrades your HTTPS connection to HTTP. Once a browser sees HSTS, it enforces HTTPS for the duration of the max-age value.

CSP is a powerful header that restricts which sources of content (scripts, styles, images, etc.) can be loaded on your page. A strict CSP dramatically reduces the risk of XSS attacks by preventing injected scripts from loading resources from attacker-controlled domains.

X-Frame-Options prevents your site from being embedded in iframes on other domains, protecting users from clickjacking attacks where malicious pages trick users into clicking on hidden elements from your site. Modern sites should use Content-Security-Policy frame-ancestors instead.

For Next.js, add headers in next.config.ts. For Nginx, add them in the server block. For Apache, use .htaccess or httpd.conf. For Cloudflare, use Transform Rules. CertNotify monitoring can alert you if security headers change or disappear after deployments.