Free Security Headers Checker

Analyse any website's HTTP security headers — HSTS, CSP, X-Frame-Options, and more. Get a security grade and actionable recommendations instantly.

What This Checker Analyses

Six critical HTTP security headers graded A+ to F — with specific fix instructions for each one.

Strict-Transport-Security (HSTS)
Forces all connections to use HTTPS. Prevents SSL stripping attacks where an attacker downgrades your connection from HTTPS to HTTP before it reaches your server.
Content-Security-Policy (CSP)
Restricts which resources the browser can load and from where. The most effective defence against Cross-Site Scripting (XSS) — the most common web vulnerability.
X-Frame-Options (XFO)
Prevents your site from being embedded in iframes on other domains. Stops clickjacking attacks where a malicious page overlays your UI and hijacks user clicks.
X-Content-Type-Options (XCTO)
Prevents browsers from guessing the content type of a response. Stops MIME sniffing attacks that can force a browser to execute a file as a script despite its declared type.
Referrer-Policy (RP)
Controls how much referrer information is included when users navigate away from your site. Protects user privacy and prevents sensitive URL parameters from leaking to third parties.
Permissions-Policy (PP)
Restricts which browser features your page can access — camera, microphone, geolocation, and more. Limits the impact of any XSS compromise by reducing available APIs.

Frequently Asked Questions

What are HTTP security headers?

HTTP security headers are response headers that a web server sends to the browser to control security behaviours. They tell the browser how to handle the content, preventing attacks like Cross-Site Scripting (XSS), clickjacking, MIME sniffing, and data injection. They are one of the easiest security improvements you can make to any website.

What is the most important security header?

Content-Security-Policy (CSP) is generally considered the most impactful, as it prevents XSS attacks by controlling which resources can be loaded. Strict-Transport-Security (HSTS) is also critical as it forces HTTPS for all connections. Both together provide strong baseline protection.

How do I add security headers to my website?

For Nginx: add headers inside your server {} block using add_header. For Apache: use Header set in .htaccess or httpd.conf. For Next.js: configure them in next.config.js headers(). For Cloudflare: use Transform Rules or Workers. For Vercel: configure in vercel.json headers array.

What is HSTS and why is it important?

HTTP Strict Transport Security (HSTS) tells browsers to always use HTTPS when connecting to your site — even if someone types http:// or clicks an HTTP link. This prevents SSL stripping attacks. The preload directive submits your domain to browser preload lists, providing even stronger protection.

What is Content Security Policy?

CSP is a browser security feature that restricts what resources a page can load and from where. It prevents XSS attacks by blocking inline scripts and unauthorized external sources. A typical policy looks like: default-src 'self'; script-src 'self' 'nonce-...'. Start with report-only mode to test without breaking your site.

Will adding security headers break my website?

It can if not configured carefully. Content-Security-Policy in particular requires careful setup — a too-strict policy can break third-party scripts, fonts, and images. Always test with Content-Security-Policy-Report-Only first. HSTS, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy are generally safe to add immediately.