Security headers checker
We'll look at the security instructions your site sends to browsers (HSTS, Content Security Policy, framing protection, content-type protection and referrer policy), then explain each result in everyday words. It only reads the headers, and it isn't a security test.
What this checks
- HSTS (strict secure connections)
- Content Security Policy (CSP)
- X-Frame-Options (stops your site being framed)
- X-Content-Type-Options
- Referrer-Policy
We only read the response headers a normal visit receives. Missing headers usually show as Worth a look, not Needs fixing, except where noted below for HSTS.
This is a passive, light-touch check. It only reads what a normal browser visit and public DNS can see. It isn't a security test, a penetration test or a guarantee.
Check a site
Checking your site… This usually takes under a minute.
What your result means
HSTS (strict secure connections)
- Pass: Your site tells browsers to always use the secure version, for at least six months.
- Worth a look: This setting is there, but for less than six months.
- Needs fixing: This setting is missing, so a browser could be tricked into using an insecure connection.
- How to fix: Add the Strict-Transport-Security header with a max-age of at least 15768000 (six months). Do this only once https works everywhere on your site.
Content Security Policy (CSP)
- Pass: Your site sets clear rules about which scripts and files can run on it.
- Worth a look: You have rules, but they're loose (for example, they allow 'unsafe-inline' scripts), so they give less protection. Or you don't have rules yet, which is common on small sites but worth adding.
- How to fix: Ask your developer to add a Content-Security-Policy header that lists only the places your site loads files from. Test it in report-only mode first, so nothing breaks.
X-Frame-Options (stops your site being framed)
- Pass: Other websites can't show your pages inside their own, which helps stop click-tricks.
- Worth a look: This setting is missing, so another site could show your pages inside theirs.
- How to fix: Add X-Frame-Options: SAMEORIGIN, or frame-ancestors 'self' in your Content Security Policy.
X-Content-Type-Options
- Pass: Browsers are told not to guess what your files are, which blocks some attacks.
- Worth a look: This setting is missing.
- How to fix: Add the header X-Content-Type-Options: nosniff. It's one line, and it's safe on almost every site.
Referrer-Policy
- Pass: Your site limits what it tells other sites about the page a visitor came from.
- Worth a look: This setting is missing, so browsers use their own default. Or it shares full page addresses with other sites (unsafe-url or no-referrer-when-downgrade).
- How to fix: Add Referrer-Policy: strict-origin-when-cross-origin.
FAQs
What are security headers?
Short instructions your server sends with each page. Browsers use them to keep connections on https, limit which scripts can run, and reduce click-tricks and data leaks.
My small site has none. Is that urgent?
Missing CSP, framing, nosniff or referrer headers show as Worth a look. A missing HSTS header shows as Needs fixing, but add it only once https works across your whole site.
Will adding CSP break my site?
It can, if the rules are too strict. Start in report-only mode, then tighten the list of allowed places.
Is this a security audit?
No. It only reads the headers your site sends.