Security Tools

Security Headers Checker

Grade a website's HTTP security headers and see which protections are missing.

Not sure what to enter? Try an example: github.com

Free & instant No signup How to use FAQ

Enter a URL to scan its response for the security headers browsers rely on, with a score out of 100 and the headers you still need to add.

What are HTTP security headers?

Security headers are response headers that tell browsers how to protect visitors: Strict-Transport-Security forces HTTPS, Content-Security-Policy limits where scripts can load from, X-Frame-Options blocks clickjacking, and others control MIME sniffing, referrers and browser features. This scanner checks for each one and scores the site out of 100.

How to scan a website's security headers

Enter the domain in the box above.
Click Scan Headers.
Review which recommended headers are present and which are missing.
Add the missing ones in your web server, CDN or application configuration, then scan again.

Related checks

To look at one header in detail, start with the HSTS Checker.
For the Content-Security-Policy, use the CSP Checker.
To see every header the server sends, use the HTTP Headers Checker.

JustChecker monitors your security headers continuously and alerts you if anything regresses.

Frequently Asked Questions

Strict-Transport-Security (HSTS) once your whole site works on HTTPS, then X-Content-Type-Options: nosniff and a Referrer-Policy - all three are simple and safe. Content-Security-Policy gives the most protection but needs careful testing.

In your web server config (Nginx add_header, Apache Header set), in .htaccess on shared hosting, through a security plugin, or in your CDN's settings. The .htaccess Generator can write the common ones for you.

No - headers harden the browser side against attacks like clickjacking and content injection. You still need updates, strong passwords, backups and secure code on the server.

Share this tool:

Need a website for your business? Only $599