Which headers are checked?

It checks 6 key security headers: HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy.

Do I need to pass every check to be safe?

Not necessarily — depending on the site, some headers may not be needed. Use this as a reference indicator and decide what to apply based on your service's requirements.

Is the URL I check stored?

No. Every request is checked immediately and nothing is stored.

🛡️ HTTP Headers Security Checker

Checks whether key security HTTP headers are configured.

URL

How to use

Enter the URL to check.
Click the "Check" button.
A checklist shows whether key security headers like HSTS and CSP are configured.

🎯 Use Cases

Check security headers before deploying a new service
Compare security settings against reference sites
Use as a checklist for regular security audits

Example

Input

github.com

Output

5 / 6 passed
✅ Strict-Transport-Security (HSTS)  max-age=31536000; includeSubdomains; preload
✅ Content-Security-Policy           default-src 'none'; base-uri 'self'; …
✅ X-Content-Type-Options            nosniff
✅ X-Frame-Options                   deny
✅ Referrer-Policy                   origin-when-cross-origin, strict-origin-when-cross-origin
❌ Permissions-Policy                -

An illustrative result for checking github.com: 5 of the 6 key security headers are present, with only Permissions-Policy missing. Actual values depend on the server response at the time of the lookup.

FAQ

Which headers are checked?: It checks 6 key security headers: HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy.
Do I need to pass every check to be safe?: Not necessarily — depending on the site, some headers may not be needed. Use this as a reference indicator and decide what to apply based on your service's requirements.
Is the URL I check stored?: No. Every request is checked immediately and nothing is stored.