Free tool
HTTP & security header checker
Inspect HTTP response headers and spot missing security headers such as HSTS, CSP, and X-Frame-Options — free check.
HTTP header checking fetches a URL from our servers and lists response headers, highlighting whether common security headers (HSTS, CSP, frame protections, and similar) are present.
Why headers matter
Certificates encrypt the channel; headers steer browser behavior. HSTS forces HTTPS on return visits, CSP constrains script sources, and X-Frame-Options or frame-ancestors reduce clickjacking. Missing headers are easy wins in security reviews.
How to use this checker
Enter a full URL (https://…). We perform a server-side fetch and show the response header set. Redirects may be followed depending on the endpoint behavior — compare the final app host you care about, not only the marketing apex if they differ.
- Strict-Transport-Security — enable only when HTTPS is solid
- Content-Security-Policy — start in report-only if needed
- Referrer-Policy and Permissions-Policy — reduce data leaks
False comfort
Present headers do not prove a site is secure. Misconfigured CSP can be bypassed; HSTS with a tiny max-age barely helps. Treat this as a visibility tool, then harden intentionally.