Free tool

Security headers checker

Grade your site's HTTP response headers. HSTS, CSP, X-Frame-Options, COOP, CORP, COEP — plus SSL and server fingerprint exposure. Free, instant, no signup.

Why security headers matter

HTTP response headers are the cheapest layer of defense against common web attacks. HSTS forces HTTPS. CSP blocks XSS and data exfiltration. X-Frame-Options prevents clickjacking. Each is one line of config — and most production sites are missing at least three.

Across 299 sites we've scanned, 98% are missing HSTS, CSP, and X-Frame-Options. The fix is a single paste at your CDN — but the gap is universal.

What we check

  • HSTS — force HTTPS
  • CSP — block XSS
  • X-Frame-Options — clickjacking
  • X-Content-Type-Options — MIME sniffing
  • Referrer-Policy — referrer leaks
  • Permissions-Policy — browser features
  • COOP / CORP / COEP — cross-origin isolation
  • SSL + server fingerprint — implementation exposure