Security Headers Checker
Inspect HTTP security headers and discover practical configuration snippets to protect your users from XSS, clickjacking, and protocol downgrade attacks.
Inspects HTTP response headers for essential browser security policies including HSTS, CSP, and X-Content-Type-Options.
Harden Web Applications with Defensive HTTP Headers
Modern web browsers implement powerful security boundaries that remain inactive unless explicitly commanded by HTTP response headers. Deploying a defense-in-depth header strategy significantly reduces your attack surface.
Core Security Headers Evaluated
- Strict-Transport-Security (HSTS): Enforces strict HTTPS connections and prevents protocol downgrade attacks.
- Content-Security-Policy (CSP): Restricts executable script sources to neutralize Cross-Site Scripting (XSS).
- X-Content-Type-Options: Disables MIME-type sniffing to prevent script execution via uploaded media files.
- X-Frame-Options: Prevents unauthorized embedding in iframes to defend against Clickjacking.
- Referrer-Policy: Protects user privacy and sensitive URL parameters during external navigation.
- Permissions-Policy: Explicitly controls browser features (camera, microphone, geolocation, payment).
Help & FAQs
Frequently Asked Questions
Common questions and technical guidance about this tool.
Discover More
Related Free Tools
Security.txt Generator
Generate an RFC 9116 compliant security.txt file to establish a clear vulnerability disclosure and reporting policy.
Meta Tag Checker
Inspect titles, descriptions, canonical URLs, robots directives, Open Graph tags, and heading structure with clear diagnostic insights.
Schema Markup Generator
Generate valid JSON-LD structured data for Organizations, WebSites, Articles, Products, Local Businesses, Breadcrumbs, and FAQs.