HTTP Header Checker
Check HTTP response headers and analyze security headers for any website. Get a security score based on best practices like HSTS, CSP, and X-Frame-Options.
About HTTP security headers
Modern browsers honour a small set of HTTP response headers that harden a site against common web attacks. Headers like Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy each defend against a different class of risk — protocol downgrade, cross-site scripting, clickjacking, MIME sniffing, referrer leakage, and abusive feature access. Sending the right headers costs nothing in performance and is one of the highest-leverage hardening changes you can make.
This tool issues a live request to any URL and inspects the response headers, scoring each one against current best practice. The scoring is consistent with checks performed by tools like Mozilla Observatory and securityheaders.com, so improvements made here will move those scores too.
Frequently asked questions
What are HTTP security headers?
Response headers that instruct the browser to apply additional protections against common web attacks like XSS, clickjacking, and protocol downgrade.
What does HSTS do?
Strict-Transport-Security tells the browser to only ever connect to the domain over HTTPS, even if a user types http:// or follows a plain-HTTP link. This prevents protocol-downgrade and cookie-hijack attacks on public Wi-Fi.
Is Content-Security-Policy required?
Not by any standard, but it is the single most effective header for mitigating cross-site scripting. A well-tuned CSP turns most XSS bugs into harmless console errors.
How can I improve my header score?
Add the missing headers from the report. The biggest wins are usually adding HSTS, defining a CSP that forbids inline scripts, setting X-Content-Type-Options: nosniff, and adding a strict Referrer-Policy.