Security Tools

Security Headers Checker

Grade a website's HTTP security headers and see which protections are missing.

Not sure what to enter? Try an example: github.com

Free & instant No signup How to use FAQ

70/100

github.com

Present

Strict-Transport-Security

Content-Security-Policy

X-Frame-Options

X-Content-Type-Options

Referrer-Policy

X-XSS-Protection

Missing

Permissions-Policy

Cross-Origin-Opener-Policy

Cross-Origin-Embedder-Policy

Cross-Origin-Resource-Policy

Last checked: 31 seconds ago Cached

Download JSON Download PDF

70/100

Result Summary

Passed

Strict-Transport-Security header present

Content-Security-Policy header present

X-Frame-Options header present

X-Content-Type-Options header present

Referrer-Policy header present

X-XSS-Protection header present

Failed

Permissions-Policy header missing

Cross-Origin-Opener-Policy header missing

Cross-Origin-Embedder-Policy header missing

Cross-Origin-Resource-Policy header missing

How to Fix

Add a Permissions-Policy header to restrict which browser features and APIs the site may use.

Add a Cross-Origin-Opener-Policy header to isolate the browsing context from cross-origin windows.

Add a Cross-Origin-Embedder-Policy header to prevent loading cross-origin resources that don't explicitly grant permission.

Add a Cross-Origin-Resource-Policy header to control which origins may embed this site's resources.

Enter a URL to scan its response for the security headers browsers rely on, with a score out of 100 and the headers you still need to add.

What are HTTP security headers?

Security headers are response headers that tell browsers how to protect visitors: Strict-Transport-Security forces HTTPS, Content-Security-Policy limits where scripts can load from, X-Frame-Options blocks clickjacking, and others control MIME sniffing, referrers and browser features. This scanner checks for each one and scores the site out of 100.

How to scan a website's security headers

Enter the domain in the box above.
Click Scan Headers.
Review which recommended headers are present and which are missing.
Add the missing ones in your web server, CDN or application configuration, then scan again.

Related checks

To look at one header in detail, start with the HSTS Checker.
For the Content-Security-Policy, use the CSP Checker.
To see every header the server sends, use the HTTP Headers Checker.

JustChecker monitors your security headers continuously and alerts you if anything regresses.

Frequently Asked Questions

Strict-Transport-Security (HSTS) once your whole site works on HTTPS, then X-Content-Type-Options: nosniff and a Referrer-Policy - all three are simple and safe. Content-Security-Policy gives the most protection but needs careful testing.

In your web server config (Nginx add_header, Apache Header set), in .htaccess on shared hosting, through a security plugin, or in your CDN's settings. The .htaccess Generator can write the common ones for you.

No - headers harden the browser side against attacks like clickjacking and content injection. You still need updates, strong passwords, backups and secure code on the server.

Share this tool:

Need a website for your business? Only $599