Free tool
Enter a URL and see which of the five HTTP security headers it actually sends. We request the page from our own servers and read the real response, so you get the headers a visitor receives rather than what a config file says they should.
The check runs from our servers, not your browser. We record the host you check, your IP address and your browser string to prevent abuse, and Cloudflare Turnstile verifies the request. We never store the page itself.
Example result
3 of 5 checks passed
example.com, illustrative. Run a check for your own.
The short answer
The one-paragraph version, before the detail.
HTTP security headers are instructions a web server sends alongside a page, telling the browser which behaviours to allow and which to refuse. They are not a firewall and they do not fix vulnerable code: they narrow what an attacker can do with a flaw that already exists, which is why they are called defence in depth. Five of them do most of the work, and this page checks all five.
The five headers
One paragraph each, in the order the checker reports them.
Content-Security-Policy
Lists the sources a page may load scripts, styles and frames from. With one in place, a script injected through a flaw elsewhere is refused because its origin is not on the list. The most powerful of the five and the most work to adopt: a strict policy can block your own scripts, so most teams ship it in report-only mode first.
Strict-Transport-Security
Tells the browser to use https for this site from now on, without trying http first. That closes the gap on a visitor's very first request of the day, which can otherwise be intercepted before the redirect to https happens. It only means anything on an https page, which is why the checker reports it as not applicable on a plain http URL rather than as a failure.
X-Frame-Options
Either an X-Frame-Options header or a frame-ancestors directive inside your Content-Security-Policy. Both tell the browser who may embed the page in a frame, which stops a hidden copy of your site being layered under someone else's buttons. The checker accepts either: frame-ancestors is the modern form, and a policy carrying it needs no X-Frame-Options.
X-Content-Type-Options
Set to nosniff, it tells the browser to believe the content type you declared instead of guessing from the bytes. Without it, a file meant to be plain text or an image can be interpreted as a script, which turns an ordinary upload feature into a way to run code. One fixed value, nothing to get wrong.
Referrer-Policy
Controls how much of the current URL is passed on when a visitor follows a link away from your site. Without one, the full address travels to the destination, including any token or search term in the path or query string. It is the difference between a third party learning that someone came from your site and learning which page they were reading.
Each of these in more depth, with the values worth setting: read the complete 2026 checklist.
Scope
Headers are one control on one page. A compliance scan is a different question, and this page is honest about the difference.
| What is checked | This checker | Full scan |
|---|---|---|
| Pages read | One URL | Every page crawled |
| Response headers | Included | Included |
| All six dimensions | Not included | Included |
| Accessibility rules | Not included | Included |
| Exportable evidence | Not included | Included |
| Documented rules run | 5 | 49 |
| Account needed | Not included | Not included |
FAQ
Including what this tool cannot tell you.
Free compliance scan
Six dimensions, 49 documented rules, and the exact fix for each finding, mapped clause by clause to the instruments your auditors cite.
No account, up to 5 pages on a guest scan. Or choose your plan.