Security Headers Checker
Check your website's HTTP security headers instantly. Get a security grade, see what's missing, and understand what each header protects against.
What does this tool check?
HSTS & CSP
The two most critical headers: HSTS enforces HTTPS, CSP prevents cross-site scripting attacks.
Clickjacking Protection
Checks X-Frame-Options to confirm your site cannot be embedded in malicious iframes.
Content Type Sniffing
Verifies X-Content-Type-Options is set to prevent browsers from guessing file types.
Security Grade
Overall A+ to F grade based on which headers are present, so you know exactly where you stand.
Frequently Asked Questions
What are HTTP security headers?
HTTP security headers are response headers that your web server sends to browsers to control their behaviour. They instruct the browser to enforce HTTPS, restrict what scripts can run, prevent embedding in iframes, and more — protecting users from attacks like XSS, clickjacking, and protocol downgrade.
What is HSTS and why is it important?
HSTS (HTTP Strict Transport Security) tells browsers to only connect to your site over HTTPS, forever. Without it, attackers can strip HTTPS at the network level and intercept traffic. HSTS is the single most important security header for any site that uses HTTPS.
How do I add a Content Security Policy?
Add a Content-Security-Policy header in your web server config (Nginx: add_header, Apache: Header always set), your CDN (Cloudflare Transform Rules), or application middleware. Start with report-only mode to see violations before enforcing. A strict CSP is the most powerful defence against XSS attacks.
What does X-Frame-Options do?
X-Frame-Options: DENY or SAMEORIGIN prevents your pages from being loaded in iframes on other websites. This blocks clickjacking attacks where attackers overlay a hidden version of your site to trick users into clicking buttons or logging in. The modern CSP frame-ancestors directive provides the same protection with more flexibility.
How do I get an A+ security headers grade?
To score A+, you need all eight headers: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy (COOP), and Cross-Origin-Embedder-Policy (COEP). Start with HSTS and CSP as they carry the most weight, then add the remaining headers one by one. Many hosting platforms and CDNs let you add headers with no code changes.
Monitor your security headers 24/7
Security headers go missing in deployments more often than teams realise. Uptrue's security headers monitoring checks every six hours and pairs naturally with SSL certificate monitoring for the full transport-security picture.
Start Monitoring Free