Free tool
are your security headers set?
Point it at any site and see which HTTP security headers are present, which are missing, and what each one actually protects against. No sign-up, no email.
what each header actually does.
Strict-Transport-Security
HSTS. Tells browsers to only ever reach the site over HTTPS, so a stripped or downgraded connection is refused rather than silently allowed.
Content-Security-Policy
CSP. Declares where scripts, styles and images may load from. A tight policy is the strongest defence against cross-site scripting — and the fiddliest to get right.
X-Content-Type-Options
Set to nosniff, it stops the browser guessing a response's type. That guessing is what can turn an innocent file upload into an executable script.
X-Frame-Options
Controls who may embed the page in a frame. Without it — or a CSP frame-ancestors rule — the page can be overlaid invisibly for a clickjacking attack.
Referrer-Policy
Decides how much of the current URL is handed to sites you link out to. A sensible policy keeps paths and query strings from leaking to third parties.
Permissions-Policy
Switches off browser features the site does not use — camera, microphone, geolocation — so a compromised script cannot quietly reach for them.
headers are one layer.
These headers are set at the web server, and getting them right is worth doing wherever you host. On our platform a web application firewall filters requests before they reach your site and malware scanning runs against your files — included, not sold back to you as a bolt-on.
header questions
What are HTTP security headers?
They are instructions a web server sends alongside every page, telling the browser how to behave more safely — to insist on HTTPS, to restrict where scripts can load from, to refuse to be embedded in a frame, and so on. They are defence in depth: none of them fix a vulnerability in your code, but together they close off common ways an attacker turns a small flaw into a real compromise.
Which headers matter most?
If you fix three, make them Strict-Transport-Security, Content-Security-Policy and X-Content-Type-Options. HSTS forecloses downgrade attacks, a Content Security Policy is the single most effective guard against cross-site scripting, and nosniff stops the browser misinterpreting a response as something executable. Referrer-Policy, Permissions-Policy and framing protection are worth adding once those are in place.
Does a missing header mean my site is insecure?
Not on its own. A missing header is a missing safety net, not an open door — plenty of sites run fine without a full set. What it means is that if a flaw does appear, one of the layers that would have contained it is not there. The headers are cheap to add and hard to get wrong, which is why their absence is worth noticing.
Do you store the sites I check?
No. The address is fetched once, the response headers are graded and the result is returned to you; nothing is logged against your check. The tool is rate-limited only to stop it being used to hammer other people's servers.