Security Headers Checker

HTTP security headers are your website's first line of defense. They instruct browsers on how to handle your content, preventing common attacks like clickjacking, cross-site scripting, and MIME-type confusion.

Headers We Check

• Content-Security-Policy (CSP) — Controls which resources can be loaded, preventing XSS and data injection
• Strict-Transport-Security (HSTS) — Forces HTTPS connections, preventing downgrade attacks
• X-Frame-Options — Prevents clickjacking by controlling iframe embedding
• X-Content-Type-Options — Prevents MIME-type sniffing attacks
• Referrer-Policy — Controls how much referrer information is shared
• Permissions-Policy — Restricts browser features like camera, microphone, geolocation

Why are security headers important?

They prevent entire classes of attacks (clickjacking, XSS, MIME confusion) with zero impact on user experience. Setting them is one of the easiest security wins for any website.

What is Content-Security-Policy?

CSP tells the browser which sources of content (scripts, styles, images) are allowed. This prevents XSS attacks by blocking any script that isn't explicitly whitelisted.

How do I add security headers?

Add them in your web server configuration (nginx.conf, .htaccess, or web.config), CDN settings (Cloudflare, AWS CloudFront), or application middleware.

Every day you wait is another day hackers have the advantage

Scan your website now — free, instant, no signup.