Free Security Headers Checker
Check your site for the HTTP response headers that matter, HSTS, Content-Security-Policy, clickjacking protection and more, in about thirty seconds. Part of a free, passive external snapshot.
What security headers are
Security headers are instructions your web server sends with every response that tell the browser how to behave more safely: to stay on HTTPS, to refuse to run untrusted scripts, to refuse to be framed by another site, and more. They are a low-effort layer that raises the cost of several common attacks.
Why they matter
Missing headers do not break your site, which is why they are so often overlooked, but each one closes a real avenue: HSTS stops silent downgrades to unencrypted HTTP, a Content-Security-Policy limits the damage of a cross-site scripting bug, and framing protection stops clickjacking. Together they harden the browser side of your application.
How to read your result
The check reads your live response headers and reports on HSTS, Content-Security-Policy, X-Frame-Options or frame-ancestors, X-Content-Type-Options, Referrer-Policy, and whether your software version leaks in the Server header. Each missing header is scored by severity and fix effort, with the specific header to add.
How to fix it
Add the headers at your web server, framework or CDN so they apply to every response. Start with the high-value ones: force HTTPS and add Strict-Transport-Security, set X-Frame-Options or a frame-ancestors directive, and add X-Content-Type-Options: nosniff. Introduce a Content-Security-Policy in report-only mode first, then enforce it.
See your whole external surface
This is one of the checks in Secvura’s free Surface Check. The same passive snapshot also covers your TLS certificate, cookies, the rest of your email security, and more, each scored by severity and fix effort, with an A-to-F Surface Score.
Run the full Surface Check →Frequently asked
Is the security headers check free?
Yes, completely free with no sign-up. You also get your TLS certificate, cookie flags, and email security in the same snapshot.
Are missing security headers a serious problem?
On their own they are usually low to medium severity, and plenty of solid sites are missing some. They are cheap, high-value hardening rather than an open door, which is why we score them by both severity and effort.
Will adding these headers break my site?
Most are safe to add immediately. The one to introduce carefully is Content-Security-Policy, which is why we recommend running it in report-only mode first to find any breakage before you enforce it.
More free checks