Skip to content
Cloudhim

Security Headers Checker

Check a site’s HTTPS and security headers (HSTS, Content-Security-Policy, X-Frame-Options and more) and its cookies, with advice on each.

Checked from this site’s server

What this checks

Security headers are instructions a site sends with every page, telling browsers to switch on protections they would not use by default. This tool follows the address to its final page and checks:

  • HTTPS: whether the page is encrypted, and whether the http:// address redirects to https://.
  • Strict-Transport-Security (HSTS): makes browsers use HTTPS for the site from then on, even when someone types http://.
  • Content-Security-Policy (CSP): limits where scripts and other resources may come from. It is the strongest protection against cross-site scripting (XSS), and the hardest to get right, so start with Content-Security-Policy-Report-Only.
  • X-Content-Type-Options: nosniff: stops browsers treating a file as a different type than declared.
  • X-Frame-Options or CSP frame-ancestors: stops other sites showing the page in a hidden frame to trick clicks (clickjacking).
  • Referrer-Policy and Permissions-Policy: limit what is shared with other sites, and which browser features the page may use.
  • Cookies: whether each cookie the page sets has the Secure, HttpOnly and SameSite attributes.
  • Headers that reveal software versions, such as X-Powered-By.

The count at the top is how many of six recommended protections are in place (HSTS, CSP, nosniff, framing, Referrer-Policy and Permissions-Policy). It is not a grade: a missing Permissions-Policy matters far less than a missing HTTPS redirect. Read the notes.

Adding the headers

A good starting set for most sites, served over HTTPS:

Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()

Add them in your web server’s configuration (an Apache .htaccess file with Header always set …, or add_header … always; in nginx), or in your CDN’s settings. Only add includeSubDomains when every subdomain works over HTTPS, and build a Content-Security-Policy around what your pages actually load.

Privacy

The address you enter is sent to this site, whose server fetches the page’s headers (not its content). No cookies or sign-in details are sent, and only public internet addresses are reached. The result is kept for about a minute.

Browse all tools