Security Headers Checker
Scan your HTTP response headers for missing security protections.
Security Headers Scanner
Analyze your website's HTTP response headers to ensure it is protected against clickjacking, XSS, sniffing attacks, and more.
Enter a URL above to audit its security headers against industry standards.
Why Security Headers Matter
When a browser requests a page from your server, the server responds with the content and HTTP response headers. Security headers instruct the browser on how to behave when handling your site's content, significantly mitigating risks like Cross-Site Scripting (XSS), Clickjacking, and packet sniffing.
The Most Important Headers
- Strict-Transport-Security (HSTS): Forces the browser to load your site over HTTPS, preventing downgrade attacks.
- Content-Security-Policy (CSP): An effective measure to protect your site from XSS attacks. It whitelists approved sources of content that the browser may load.
- X-Frame-Options: Tells the browser whether you want to allow your site to be framed or not. This protects against Clickjacking attacks.
- X-Content-Type-Options: Stops a browser from trying to MIME-sniff the content type and forces it to stick with the declared content-type.
Related Guides
Deepen your understanding with our expert articles.