Security headers:Is your site sending the security headers browsers expect?
See which security headers and cookie flags your site sends, which are missing or leak version numbers, and the one line that adds each one.
- Free, no account
- Results in under a minute
- Any public URL
example-shop.hr
WordPress 6.8Sample shop · homepage · mobile Chrome · the same check you get for your own site
4 passed · 0 failed · 5 warnings. Biggest issue: Content-Security-Policy header is missing.
What we found
Show 4 passed checks
Fix these first
From the example above. Check your own site to get the fixes that apply to it.
Warning: Content-Security-Policy header is missing
A CSP blocks most cross-site scripting attacks by listing where scripts may load from.
How to fix it: Start in report-only mode with Content-Security-Policy-Report-Only to see what would break.Warning: Other sites can embed this page in a frame
A site that loads your page in an invisible frame can trick visitors into clicking your buttons (clickjacking), for example "confirm order" or "delete account".
How to fix it: Add frame-ancestors 'self' to your Content-Security-Policy, or send X-Frame-Options: SAMEORIGIN.Warning: X-Content-Type-Options header is missing
Without it, browsers may guess a file's type from its content and run an uploaded image or text file as a script.
How to fix it: Send the header: X-Content-Type-Options: nosniff on every response.
What this tool checks
Fourteen checks on the response headers and cookies, graded against the MDN HTTP Observatory rules.
HSTS header
Checks the header that keeps return visits on HTTPS, so they never start on interceptable plain HTTP.
HSTS preload readiness
Checks your HSTS header qualifies for the browsers' built-in HTTPS-only list.
Content-Security-Policy header
Checks for the header that limits where scripts may load from, blocking most injected scripts.
Inline and wildcard scripts in CSP
Checks your Content-Security-Policy doesn't still allow inline or wildcard scripts that weaken it.
X-Content-Type-Options header
Checks browsers are told not to guess file types, so an uploaded file can't run as a script.
Frame embedding protection
Checks other sites can't load your page in a hidden frame to trick visitors into clicking.
Referrer-Policy header
Checks how much of your page addresses, including parameters, is passed on to the next site.
Permissions-Policy header
Checks unused browser features like camera and microphone are switched off for scripts and iframes.
Secure flag on cookies
Checks cookies are only sent over HTTPS, so nobody on the network can copy a session.
HttpOnly flag on cookies
Checks cookies are hidden from page scripts, so an injected script can't steal a session.
SameSite attribute on cookies
Checks cookies say when other sites may send them, which protects against forged requests.
Server version in headers
Checks the Server header doesn't reveal the software version that automated scanners look for.
Show 10 more checks
X-Content-Type-Options header
Checks browsers are told not to guess file types, so an uploaded file can't run as a script.
Frame embedding protection
Checks other sites can't load your page in a hidden frame to trick visitors into clicking.
Referrer-Policy header
Checks how much of your page addresses, including parameters, is passed on to the next site.
Permissions-Policy header
Checks unused browser features like camera and microphone are switched off for scripts and iframes.
Secure flag on cookies
Checks cookies are only sent over HTTPS, so nobody on the network can copy a session.
HttpOnly flag on cookies
Checks cookies are hidden from page scripts, so an injected script can't steal a session.
SameSite attribute on cookies
Checks cookies say when other sites may send them, which protects against forged requests.
Server version in headers
Checks the Server header doesn't reveal the software version that automated scanners look for.
X-Powered-By header
Checks the site doesn't announce its programming language and version to anyone who asks.
Wildcard CORS header
Checks the page doesn't let any website read its response from inside a visitor's browser.
Show 2 more checks
X-Powered-By header
Checks the site doesn't announce its programming language and version to anyone who asks.
Wildcard CORS header
Checks the page doesn't let any website read its response from inside a visitor's browser.
How it works
Request the page
We request your page like a browser does and follow every redirect to the final response.
Grade the headers
HSTS, Content-Security-Policy, X-Content-Type-Options, framing protection, Referrer-Policy and Permissions-Policy are graded against the MDN HTTP Observatory rules.
Check cookies and leaks
Every cookie is checked for the Secure, HttpOnly and SameSite flags, and the headers are checked for server and framework version leaks.
We check the headers of the one page you enter. Other pages or paths on your server can send different headers.
Questions
Is this really free?
Yes. getReport is funded by donations, not plans. This tool runs the full report and shows you the part it is about; the complete report with all seven modules is one click away, also free.
Do you store my headers?
The response headers are kept as part of the report for 12 months so the technical detail stays readable. Request headers, cookie values and anything from your visitors are never stored.
How is this different from securityheaders.com?
Same idea, more context: every missing header comes with why it matters and how to add it on Apache, nginx, LiteSpeed or Cloudflare, and the result sits inside a full report with TLS, cookies and exposed files.
Can I run this on many sites?
You can check 10 sites every 10 minutes and 50 a day from one connection. For more at once, the bulk URL checker and the bulk PageSpeed checker take lists of URLs; a free API is in development. Cached reports never count against the limit.
Do security headers help SEO?
Not directly; Google does not rank on headers. They make a successful attack less likely, and a hacked site gets a Safe Browsing warning in Chrome and in Google's results and loses traffic fast. Most headers are one line in the web server or CDN configuration. A Content-Security-Policy takes longer; start it in report-only mode.
Related free tools
All 41 tools →Free, funded by the people who use it
€0 of €75 this month. At €75, site crawl up to 500 pages + weekly re-check switches on for everyone.