Free security headers checker
Type your address. We load the page the way a browser does and read the headers that protect your visitors, then tell you which are missing or weak and the line to add for each.
What you get
- Strict-Transport-Security: whether browsers are told to always use HTTPS, and for how long.
- Content-Security-Policy: whether injected scripts are limited, and whether 'unsafe-inline' undoes it.
- X-Frame-Options or frame-ancestors (clickjacking), X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
- Whether http:// redirects to https://, and which software versions the site gives away.
- The exact lines to add, and where to add them on Cloudflare, Nginx, Apache, WordPress hosting and hosted platforms.
Common questions
Do missing headers mean my site is hacked?
No. They are extra locks that make some attacks harder. A site can be safe without all of them, but HSTS, X-Content-Type-Options and frame protection are cheap to add and rarely break anything.
Will adding a Content-Security-Policy break my site?
It can, if it blocks a script you rely on. That is why the line we suggest is report-only: it blocks nothing and shows what would be blocked in the browser console, so your web person can tune it before switching it on.
My site is on Shopify, Wix or Squarespace. Can I add these?
Mostly not: the platform sends the headers for every shop or site it hosts. The result still tells you what they set, which is useful when a customer or insurer asks.
Get told when it changes
Add the site to a free account and we check it every five minutes, with certificate, domain and email security alerts in plain English.