Security Header Analyzer

Check whether a site sets the headers that protect visitors, such as HSTS, Content-Security-Policy and X-Frame-Options.

The headers that matter

HSTS: forces browsers to use HTTPS only.
Content-Security-Policy: limits where scripts and resources can load from, the strongest defence against cross-site scripting.
X-Frame-Options: stops your page being embedded in a frame, which prevents clickjacking.
X-Content-Type-Options: stops the browser guessing file types.
Referrer-Policy: controls how much address information is shared when users click away.
Permissions-Policy: restricts powerful features like camera and location.

See the raw response with the HTTP header checker, or verify a site's SSL certificate.

Frequently asked questions

What is a security header?

It's an HTTP response header that tells the browser to enforce a protection, like forcing HTTPS (HSTS) or blocking the page from being framed (X-Frame-Options).

What's a good score?

More is better, but context matters. A simple static site rarely needs all six, while a site handling logins or payments should set most of them.

How do I add these headers?

They're set on your web server or hosting platform. Most frameworks and CDNs let you add response headers in a config file or dashboard.