HTTP Security Header Checker (Live)

HTTP Security Header Checker

This tool makes a live request to a URL and grades the security-relevant response headers the server sends. These headers are cheap, high-impact defences — most are a single line of server config — yet a large share of sites ship without them.

The headers that matter

• Strict-Transport-Security (HSTS) — forces browsers to use HTTPS, defeating SSL-stripping downgrade attacks. The single most important header for a site that has TLS.
• Content-Security-Policy (CSP) — the strongest in-browser defence against cross-site scripting: it constrains where scripts, styles and other resources may load from. Hard to get right, which is why it's the one most often missing.
• X-Content-Type-Options: nosniff — stops browsers from MIME-sniffing a response into an executable type.
• X-Frame-Options / frame-ancestors — prevents your pages being embedded in a hostile iframe (clickjacking).
• Referrer-Policy — controls how much of the referring URL leaks to other origins.
• Permissions-Policy — disables powerful browser features (camera, geolocation…) you don't use.

Why the "live" distinction matters

A paste-the-headers checker only sees what you already have. This one fetches the URL itself, so it reflects exactly what a real browser receives — including headers added or stripped by a CDN, proxy, or framework in front of your app. That's frequently where the surprise is.

Common mistakes

• Setting CSP in report-only mode and forgetting to enforce it.
• HSTS without includeSubDomains (or without preloading) leaving subdomains exposed.
• Relying on X-Frame-Options alone; modern practice is CSP frame-ancestors.