free tool
Security headers checker
Enter an address and we read what its page sends back: the security headers, the cookies it sets and its security.txt. What to fix is kept apart from what is only advice.
No account and no card. For every check at once, run the free website health check.
01 / what it reads
Issues and advice, kept apart
We request the page once, the way a browser does, and read the response. The only other request is for security.txt.
Counted as issues
Served over plain HTTP. No HSTS, or HSTS with max-age=0. No X-Content-Type-Options: nosniff. No frame protection. A cookie without Secure on an HTTPS site. A security.txt that has expired or names no contact.
Listed as advice
No Content-Security-Policy, or one that lets most scripts through. HSTS shorter than six months. No Referrer-Policy or Permissions-Policy. Cookies without HttpOnly or SameSite. A software version in the Server header. No security.txt.
02 / limits
What it does not check
It reads one response. It does not attack anything, and it cannot see what the page does once it is running in a browser.
- Other pages: each one can send different headers. Check a login or checkout page by entering its address.
- Cookies set later by scripts in the browser, such as analytics or a consent banner; only the ones in the response are read.
- Vulnerabilities in the software behind the site. A clean result is not a clean bill of health.
- The TLS configuration. The SSL certificate checker reads the certificate itself.
questions
Questions
Which security headers should a website have?
Three are cheap and worth having on any site: Strict-Transport-Security (browsers stick to HTTPS), X-Content-Type-Options: nosniff (a file is never run as something it was not served as) and frame protection, through X-Frame-Options or a CSP frame-ancestors (other sites cannot embed and overlay your page). Their absence is what this checker counts as an issue.
Referrer-Policy, Permissions-Policy and a Content-Security-Policy are worth adding too, and are listed as advice.
Why is a missing Content-Security-Policy only advice?
A CSP is the strongest of these headers and the easiest to get wrong: a policy that is too strict breaks the site's own scripts, and almost no small site has one. Marking its absence as a failure would make nearly every site look broken. It is listed, with what to do, and it does not count against the result.
My site runs on Shopify, Wix, Squarespace or Webflow. Can I fix these?
Mostly not: on those platforms the platform sets the response headers and the cookies, not you. When the checker recognises one of them, what it finds is still shown, marked as not fixable on that platform, and not counted.
What is security.txt?
A small text file at /.well-known/security.txt (RFC 9116) that tells someone who found a security problem how to reach you. It needs a Contact line and an Expires date. Not having one is advice; having one that expired or names no contact is an issue, because it points people at nothing.
Is this a vulnerability scan?
No. It reads the response your page sends to any visitor and requests one public file. It does not probe for weaknesses, try paths, or test the server, and a clean result does not mean the site cannot be attacked.
Can this be checked automatically?
Yes, on every plan, by monitoring the site. The headers are read daily from the page the uptime check already fetches, shown on the site's page and counted in its security grade.
Other free checks
-
SSL certificate checker
Checks a site's TLS certificate once, now: whether a browser trusts it, who issued it and how many days it has left.
-
Domain expiry checker
Looks a domain up with its registry over RDAP or WHOIS and reports the registrar and the date the registration runs out.
-
Broken link checker
Follows the links on one page and lists the ones that no longer answer, separately from those whose server turned the check away.
-
Meta tag checker
Reads one page's title, meta description, social image and mobile viewport, and says which are missing.
-
Email spoofing checker
Reads a domain's SPF, DMARC and MTA-STS records and says whether someone could send mail that appears to come from it.
-
Website health check
Every check at once: uptime, the certificate, the domain, links and meta tags.
Headers go missing after a deploy
Monitoring re-reads them daily and counts them in each site's A–F security grade. Free covers 3 sites, takes no card and keeps running for as long as somebody signs in.