Security headers check
See in seconds which browser defenses your website switches on, and the exact line to add for each one that is missing. We ask for your home page once, as a browser does, and read only its headers.
Questions
- What are security headers?
- Lines your server adds to every answer that tell the browser how to protect your visitors: which scripts may run, whether the page may be framed by another site, whether plain HTTP is ever allowed. They cost nothing to add and stop whole classes of attack.
- Which headers are checked?
- Four with a clear right answer: Content-Security-Policy (which scripts may run), Strict-Transport-Security (HTTPS only, always), X-Frame-Options or frame-ancestors (no invisible framing) and X-Content-Type-Options: nosniff (no guessing file types). Each missing one comes with the exact line to add.
- Is it safe to check any website?
- Yes. We ask for the home page once over HTTPS, as any browser does, and read only the headers of the answer. The page itself is never read or stored, and one site is read at most once every five minutes, however many people check it.
- Does a missing header mean my site was hacked?
- No. A missing header is a missing layer of protection, not a break-in. It matters most when something else goes wrong, which is exactly when you want it there.