Which headers are checked?

It checks 6 key security headers: HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy.

Do I need to pass every check to be safe?

Not necessarily — depending on the site, some headers may not be needed. Use this as a reference indicator and decide what to apply based on your service's requirements.

Is the URL I check stored?

No. Every request is checked immediately and nothing is stored.

Are all of these mandatory?

Depends on the site. CSP can break existing scripts — roll it out with Report-Only first.

What if I need to allow iframe?

X-Frame-Options only blocks or allows same-origin. For named domains use CSP frame-ancestors.

🛡️ HTTP Headers Security Checker

Checks whether key security HTTP headers are configured.

URL

How to use

Enter the URL to check.
Click the "Check" button.
A checklist shows whether key security headers like HSTS and CSP are configured.

🎯 Use Cases

Check security headers before deploying a new service
Compare security settings against reference sites
Use as a checklist for regular security audits

Example

Input

github.com

Output

5 / 6 passed
✅ Strict-Transport-Security (HSTS)  max-age=31536000; includeSubdomains; preload
✅ Content-Security-Policy           default-src 'none'; base-uri 'self'; …
✅ X-Content-Type-Options            nosniff
✅ X-Frame-Options                   deny
✅ Referrer-Policy                   origin-when-cross-origin, strict-origin-when-cross-origin
❌ Permissions-Policy                -

An illustrative result for checking github.com: 5 of the 6 key security headers are present, with only Permissions-Policy missing. Actual values depend on the server response at the time of the lookup.

Key security headers

Response headers that tell the browser which protections to enforce.

Header	Example value	Effect
Strict-Transport-Security	`max-age=31536000`	Forces HTTPS — blocks downgrade
X-Content-Type-Options	`nosniff`	Blocks MIME sniffing
X-Frame-Options	`DENY` / `SAMEORIGIN`	Stops iframe embedding — anti-clickjacking
Content-Security-Policy	Per-source allow lists	Mitigates XSS and data injection
Referrer-Policy	`strict-origin-when-cross-origin`	Limits referrer leakage
Permissions-Policy	Per-feature allow lists	Restricts camera, mic and other features

FAQ

Which headers are checked?: It checks 6 key security headers: HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy.
Do I need to pass every check to be safe?: Not necessarily — depending on the site, some headers may not be needed. Use this as a reference indicator and decide what to apply based on your service's requirements.
Is the URL I check stored?: No. Every request is checked immediately and nothing is stored.
Are all of these mandatory?: Depends on the site. CSP can break existing scripts — roll it out with Report-Only first.
What if I need to allow iframe?: X-Frame-Options only blocks or allows same-origin. For named domains use CSP frame-ancestors.