Security
Security Header Check
Check whether your website sends the important HTTP security headers – Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. With a grade, clear explanations and ready-made code to add what is missing.
- Processed on the server – Privacy
- No sign-up
- Free
Check a website
My server fetches the address once, follows up to 5 redirects and only evaluates the HTTP headers.
The most important security headers
Further notes
Content-Security-Policy in detail
Add what is missing
Suggestions with common, cautious values. After adding them, test the website thoroughly and check again.
Redirects
All response headers
Guide
How it works
- Enter an address
Enter the address of your website, e.g. example.com – the home page or exactly the subpage you specify is checked. Without a scheme, https:// is used.
- View the grade
The grade counts the six most important security headers. Red means: missing or faulty, orange: set, but could be improved. A+ requires all six and a strict CSP.
- Read the notes
“Further notes” lists things that do not affect the grade: revealed version numbers, deprecated headers, cookie settings and the redirect from http:// to https://.
- Add what is missing
On the right there is ready-made code for Apache (.htaccess), nginx and PHP – only for the headers that are missing. The CSP is deliberately suggested in test mode first so that nothing breaks.
FAQ
Frequently asked questions
What are security headers?
HTTP headers your server sends with every page that tell the browser how strict it should be: connect only via HTTPS (HSTS), only run allowed scripts (CSP), do not embed the page in other sites’ frames (X-Frame-Options) and the like. They cost nothing and rule out whole classes of attacks.
Why does the tool suggest the CSP as “Report-Only”?
A Content-Security-Policy that is too strict quickly blocks your own scripts, fonts or embedded videos. In “Report-Only” mode, the browser only reports violations in the console. Once no more reports appear there, rename the header to “Content-Security-Policy”.
Do I need X-Frame-Options if I use frame-ancestors?
No. The CSP directive frame-ancestors replaces X-Frame-Options and is supported by all current browsers. Setting both does no harm, though.
Why is X-XSS-Protection not included?
The XSS filter this header controls has been removed from all browsers – it could even open new vulnerabilities. Today, a Content-Security-Policy protects you. The header can be dropped or set to “0”.
Why does my server reveal its version?
Many servers send headers such as “Server: Apache/2.4.58” or “X-Powered-By: PHP/8.3” by default. That helps attackers look for matching vulnerabilities. For Apache this can be turned off with “ServerTokens Prod”, for PHP with “expose_php = Off” – on shared hosting often in the hosting provider’s control panel.
My result differs from other tools – why?
The grade is our own, simplified rating. In addition, servers may send different headers depending on browser, location or bot protection. If the result says “Error page”, the server rejected the request.