HTTP Headers Checker
Fetch the HTTP response headers a site sends, and see at a glance which of the six standard security headers it is missing.
Fixing missing headers
Most security headers are a single line in your web server or CDN configuration. Start with Strict-Transport-Security and X-Content-Type-Options, which almost never break anything. Content-Security-Policy takes the most care: deploy it in report-only mode first.
Remove or blank the Server version string and X-Powered-By while you are there.
Frequently asked questions
Which security headers are checked?
Strict-Transport-Security, Content-Security-Policy, X-Frame-Options (or a CSP frame-ancestors directive), X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
What can response headers reveal?
The Server and X-Powered-By headers often name the web server, framework and version, which is the first thing an attacker matches against known vulnerabilities. Caching and CDN headers show what sits in front of the site.
Where is the request sent from?
From a remote checking service, not your browser, so you see the headers an outside visitor receives. Sites that block automated requests may return an error page instead.
How do I get a full TLS and header grade?
Run the domain through the subdomain finder. Every results page includes a Mozilla Observatory security score alongside the subdomain list.
Free to use within a daily limit per visitor. Use it on systems you own or are allowed to test, see the acceptable use policy.