Security Headers Check

Security Headers Check: what it is for

Enter a website address and see which HTTP security headers it sends and which are missing: Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and Cross-Origin-Opener-Policy. Each one explains what it protects and gives a suggested value to copy. The A+ to F grade deducts points for headers that reveal the server version, like Server and X-Powered-By.

Ideal for checking a site before an audit or a penetration test.

How to use

1. Enter the site address.
2. Tap Check.
3. Add the missing headers on the server.

When to use it

• Improve your site's security grade.
• Protect the site against clickjacking.
• Check the setup after changing Nginx or Cloudflare.

Frequently asked questions

What are security headers?

Instructions the server sends with the page telling the browser how to protect itself: always use HTTPS, don't let the site be framed by another (clickjacking), where scripts may load from and which features, like camera and location, the page may request.

How is the grade calculated?

Each important header is worth points, with more weight for HSTS and Content-Security-Policy. Headers that reveal the server or language version take points away. The grade goes from A+ (all present) to F (almost none).

How do I add these headers?

On Nginx, use add_header; on Apache, Header set in .htaccess; on Cloudflare, use header transform rules; and in frameworks like Express or Next.js, a middleware such as helmet. The tool shows the suggested value for each one.

Can a Content-Security-Policy break my site?

It can, if it is too strict and blocks scripts you use. Start with Content-Security-Policy-Report-Only to only see the reports and allow the needed origins before enforcing it.

Is it really free?

Yes, 100% free. No sign-up, no subscription and no usage limits. All Tools123 are free.

Similar tools