Why Security Headers Matter
HTTP security headers protect your website against common attacks like cross-site scripting (XSS), clickjacking, MIME sniffing, and man-in-the-middle attacks. Missing headers leave your site and users vulnerable. Most headers take minutes to configure but provide significant security improvements.
What We Check
This tool checks for Content-Security-Policy (CSP), Strict-Transport-Security (HSTS), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and other security-relevant headers. Each check explains what the header does and whether it is present and correctly configured.
API Access
Use our REST API: POST /api/security/headers-check with JSON body {"url": "https://example.com"}. Returns score, grade, and individual header checks. Free for 100 calls/day.