Free Security Headers Checker
Fetch a page the way a browser does and see every response header, with the security-related ones graded and explained. No account needed.
Free, with no sign-up. Fair-use limits apply. To enforce them we keep the domain you enter and a scrambled form of your IP address for 30 days, as described in our privacy policy.
What are HTTP security headers?
Every time a browser loads a page, the server sends back a set of headers alongside the content. Some of them are instructions that make the browser behave more safely: insist on a secure connection, refuse to be embedded in another site, or restrict where scripts may load from. They cost nothing to add and block whole categories of attack, yet a large share of websites still send none of them.
This free tool requests the page you enter, records every header in the response and grades the security-related ones with a clear reason for each result.
How to use it
Enter a full web address, such as https://example.com, and press Check headers. The tool follows redirects to the final page, so you see what a visitor would see, and it reports the protocol used. You get a graded list at the top and the complete table of raw response headers underneath, which is useful when you are debugging a CDN or a caching problem.
The headers that matter most
- Strict-Transport-Security (HSTS) tells the browser to use https for your domain and never fall back to plain http.
- Content-Security-Policy limits which sources may run scripts and load resources, and is the strongest defence against injected code.
- X-Frame-Options, or the frame-ancestors part of a content security policy, stops other sites from embedding yours to trick visitors into clicking.
- X-Content-Type-Options set to nosniff stops browsers from guessing file types in unsafe ways.
- Referrer-Policy controls how much of the visited address is shared with other sites.
- Cookie settings such as Secure, HttpOnly and SameSite protect login sessions.
Reading the grades
A passed check means the header is present with a sensible value. A warning usually means it is present but weak, for example a very short HSTS lifetime, or a policy that allows unsafe inline scripts. A failure means a protection is missing. Each finding carries a plain-English explanation and the value to aim for, so you can hand the page straight to a developer.
The checker also looks at whether plain http redirects to https, how the page is cached and whether it is compressed. Compression matters for speed: switching on gzip or brotli commonly shrinks HTML by more than two thirds, which helps both visitors and Core Web Vitals.
A sensible starting set
If you are unsure where to begin, start with three headers that rarely cause trouble: X-Content-Type-Options set to nosniff, a Referrer-Policy such as strict-origin-when-cross-origin, and a frame restriction. Then add HSTS with a short lifetime. Leave the content security policy until last, because it needs the most testing. Re-run the checker after each change to confirm it took effect and that no page has lost a script or a font.
Adding headers safely
Headers are added in the web server configuration, at the CDN, or through a plugin, depending on how the site is hosted. Introduce them one at a time. HSTS is the one to treat carefully, because once browsers have been told to insist on https, a certificate problem locks visitors out rather than showing a warning, so start with a short lifetime and increase it. A content security policy is best tried in report-only mode first, since a policy that is too strict can break scripts your site relies on.
Headers work together with the certificate itself, so check that with the SSL certificate checker as well.
Keep an eye on it over time
Headers are often lost when hosting changes, a plugin is updated or a CDN rule is edited. An SEO Web Data account audits your site’s security headers as part of its technical checks and monitors uptime, certificates and performance continuously, alongside site crawls, rank tracking and reporting. It also includes more than seventy domain tools. Every plan starts with a free trial, so you can see the whole picture for your own sites.
Frequently asked questions
Will adding security headers affect my search rankings?
They are not a direct ranking factor, but a secure, well-behaved site protects visitors and avoids the browser warnings that make people leave.
Why does the checker follow redirects?
So it grades the page a visitor actually lands on. The redirect chain is shown too, so you can see each step.
Can I check a page other than the home page?
Yes. Enter the full address of any public page and the headers for that page are shown.
Does it test for vulnerabilities?
No. It reads the headers a server volunteers to every visitor. It does not probe for weaknesses or attempt any attack.
More free tools
See all free domain tools, or read how the SSL and website checks work inside the dashboard.