What does the security header checker test?

The security header checker requests the public URL, follows safe redirects and evaluates browser-facing HTTP response headers such as Content Security Policy, HSTS, X-Content-Type-Options, frame protection, Referrer-Policy, Permissions-Policy and CORS. It also reports exposed server technology headers.

What are HTTP security headers?

HTTP security headers are response instructions that tell browsers how to handle content, transport security, framing, referrer data, browser capabilities and cross-origin access. They complement secure application code but do not replace it.

What does a CSP checker look for?

The CSP checker looks for an enforced Content-Security-Policy response header and warns about broad wildcard sources or unsafe script expressions. A policy must still be tested against the resources and behavior of the individual website.

How does the HSTS checker evaluate a website?

The HSTS checker first verifies that the final URL uses HTTPS. It then reads Strict-Transport-Security and checks whether max-age is valid and at least one year. HSTS should only be enabled after HTTPS works reliably across the intended hosts.

Is a missing CORS header a security problem?

No. A missing Access-Control-Allow-Origin header normally means the tested response does not grant browser access to other origins. The CORS test warns about wildcard access or an arbitrary test origin being reflected, while recognizing that public resources can intentionally use a wildcard.

Does a high server hardening score prove that a website is secure?

No. The score summarizes the HTTP headers visible in one public response. It cannot prove that application code, authentication, dependencies, infrastructure or every route is secure. Use the result as one part of a broader security review.

Why is X-XSS-Protection not scored?

X-XSS-Protection is an obsolete browser filter and is not a modern security requirement. The checker lists it only as information and bases the score on current controls such as CSP, safe output handling and other relevant response headers.

Free HTTP security header checker

Security Header Checker for HTTP Headers and Server Hardening

Check security headers on a public website and get a weighted report for Content Security Policy, HSTS, CORS, frame protection, MIME sniffing and exposed server information.

Start header check No registration required

CSP test
HSTS test
CORS test
Frame protection test

System hardening check

Check HTTP Security Headers

Enter a public HTTP or HTTPS URL. The response header checker safely follows redirects and explains detected, weak and missing protections.

Content Security Policy Checker

The CSP test distinguishes an enforced policy from report-only mode and flags broad wildcard or unsafe script sources.

HSTS Checker

The HSTS test verifies HTTPS first and then evaluates the Strict-Transport-Security max-age returned by the final response.

CORS Header Checker

The CORS checker sends a controlled external Origin and identifies wildcard access, reflected origins and restricted allowlists.

X-Frame-Options Checker

Frame protection passes when CSP frame-ancestors or a valid X-Frame-Options value reduces clickjacking exposure.

X-Content-Type-Options Checker

The response must return nosniff to tell browsers not to reinterpret declared MIME types.

Server Header Checker

The report detects Server and X-Powered-By disclosures without inventing or changing the values returned by the website.

Security headers test

A Practical and Transparent Hardening Score

The score gives more weight to protections with broad impact, including Content Security Policy, HSTS, MIME sniffing protection and frame controls. CORS is evaluated as an access policy: no CORS header is normally safe, while unrestricted or reflected origins require review.

Advanced COOP, CORP and COEP headers are shown as optional because they are not appropriate for every website. The obsolete X-XSS-Protection header is informational and does not affect the score.

Check security headers

Run the HTTP Security Header Test in Three Steps

Use the findings as a prioritized configuration guide, then repeat the same URL check after deployment.

01
Enter the exact public URL
Test the page and hostname visitors actually use because headers can differ by route or subdomain.
02
Review status and evidence
Inspect each returned value, explanation and recommendation instead of relying only on the score.
03
Deploy carefully and retest
Roll out CSP, HSTS and cross-origin policies in stages so legitimate website functions continue to work.

Free security header checker

Check Your Website Security Headers Now

Test CSP, HSTS, CORS and other HTTP response headers without reloading the page.

Start header check

Security Header Checker for HTTP Headers and Server Hardening

Check HTTP Security Headers

What Does the Security Header Checker Analyze?

Content Security Policy Checker

HSTS Checker

CORS Header Checker

X-Frame-Options Checker

X-Content-Type-Options Checker

Server Header Checker

A Practical and Transparent Hardening Score

Run the HTTP Security Header Test in Three Steps

Enter the exact public URL

Review status and evidence

Deploy carefully and retest

Check Your Website Security Headers Now

Frequently Asked Questions About Security Headers

Give us feedback

Your feedback

Your data

Your privacy. Your choice.