🛡️ Checking Security Headers

Here's how to check whether a site has the basic web security headers set up correctly.

The headers worth checking

Strict-Transport-Security (HSTS, forces HTTPS), Content-Security-Policy (CSP, defends against XSS), X-Content-Type-Options: nosniff (blocks MIME sniffing), X-Frame-Options (prevents clickjacking), and Referrer-Policy (limits referrer leakage) are the baseline set to check.

The risk of missing each one

Without HSTS, an HTTP connection attempt is exposed to a man-in-the-middle attack (SSL stripping). Without CSP, there's no defense if malicious script gets injected into the site (XSS). Without X-Frame-Options, another site can embed yours in a hidden iframe for a clickjacking attack.

After the check

This tool only confirms whether a header is present — whether its actual value fits your project (a CSP's detailed policy, for instance) needs separate review. Adding headers has to happen in your server or CDN config, like nginx or Cloudflare.

More guides