Web Security

Security Headers Checker

Check HTTP security headers (CSP, HSTS, X-Frame-Options, X-XSS-Protection, Referrer-Policy, and more) with security scoring.

What Are Security Headers?

Security headers are HTTP response headers that instruct browsers how to behave when handling a website's content. They provide critical defense-in-depth against common web attacks including Cross-Site Scripting (XSS), clickjacking, MIME sniffing, man-in-the-middle attacks, and data injection. When a browser receives these headers, it enforces security policies that the application alone cannot guarantee, making them an essential layer of web application security.

For security professionals, checking security headers is one of the first steps in assessing a web application's security posture. Missing or misconfigured headers indicate that the application lacks fundamental browser-enforced protections. A site without Content-Security-Policy is vulnerable to XSS, a site without Strict-Transport-Security allows SSL stripping, and a site without X-Frame-Options can be framed by attacker-controlled pages.

Security headers are also a common finding in penetration test reports and compliance audits. Standards like OWASP Top 10, PCI DSS, and SOC 2 reference security headers as indicators of secure web configuration. This tool checks for all major security headers, scores their configuration, and provides actionable guidance for improvement.

Essential Security Headers Explained

Content-Security-Policy (CSP) is the most important security header. It defines which sources of content (scripts, styles, images, frames) a browser is allowed to load, effectively preventing XSS attacks by blocking inline scripts and unauthorized external resources. A well-crafted CSP is the single most effective browser-side defense against script injection attacks.

Strict-Transport-Security (HSTS) forces browsers to communicate with the site only over HTTPS, preventing SSL stripping attacks where an attacker downgrades the connection to HTTP. HSTS also protects against cookie hijacking by ensuring all traffic is encrypted. The includeSubDomains directive extends protection to all subdomains, and the preload directive allows inclusion in browser HSTS preload lists.

X-Frame-Options (XFO) and X-Content-Type-Options protect against clickjacking and MIME sniffing attacks respectively. XFO prevents a page from being embedded in an iframe on another site, stopping attackers from overlaying invisible iframes to trick users into clicking unintended elements. X-Content-Type-Options with nosniff prevents browsers from interpreting files as a different MIME type than declared.

Security Header Best Practices

Deploying security headers correctly requires understanding your application's content sources and legitimate embedding needs. A CSP that is too strict breaks functionality, while one that is too permissive provides no protection. Start with a report-only CSP to identify what your application loads, then tighten the policy incrementally. Use nonces or hashes for inline scripts rather than disabling CSP's inline protection.

HSTS should be enabled gradually. Start with a short max-age (one hour) while testing, then increase to six months or one year. Once you are confident that HTTPS works correctly across all subdomains, enable includeSubDomains and consider submitting to the HSTS preload list for maximum protection.

Headers should be applied consistently across all responses, including error pages, API endpoints, and static assets. Inconsistent header deployment creates gaps that attackers can exploit. Regular header audits using automated tools ensure that new pages and endpoints inherit the correct security configuration.

How to check security headers

1
Enter a URL
Type the full URL (including https://) of the website to check.
2
Run the check
Submit the URL to retrieve its HTTP response headers.
3
Review the score
Check the overall security score and grade based on header configuration.
4
Examine individual headers
Review each header's presence, value, and security impact with specific improvement recommendations.

Frequently Asked Questions

What are security headers?

Security headers are HTTP response headers that instruct browsers to enforce security policies. They protect against XSS, clickjacking, MIME sniffing, and other web attacks by providing browser-enforced defense-in-depth.

Which security headers are most important?

Content-Security-Policy, Strict-Transport-Security, and X-Frame-Options are the most critical. CSP prevents XSS, HSTS prevents SSL stripping, and XFO prevents clickjacking.

How do I implement Content-Security-Policy?

Start with report-only mode to learn what your site loads, then create a policy that allows only necessary sources. Use nonces for inline scripts and avoid unsafe-inline and unsafe-eval.

What is HSTS preload?

HSTS preload is a list of domains that browsers ship with hardcoded HSTS. Once included, browsers will always use HTTPS for the domain, even on first visit. Submit through the HSTSpreload.org website.

Do security headers affect performance?

No. Security headers are small HTTP response headers that add negligible overhead. They actually improve performance in some cases by enabling browser optimizations that require HTTPS.

Should I apply headers to API responses?

Yes. Apply security headers to all HTTP responses, including API endpoints, error pages, and static assets. Inconsistent deployment creates exploitable gaps.

How often should I audit security headers?

Audit headers after any deployment, configuration change, or infrastructure update. Automated CI/CD checks ensure new pages inherit the correct security configuration.

What is a nonce in CSP?

A nonce (number used once) is a random value included in a CSP directive that allows specific inline scripts to execute. It prevents XSS while permitting legitimate inline scripts. A new nonce must be generated for each request.

How do I test CSP in report-only mode?

Set Content-Security-Policy-Report-Only header with your desired policy and a report-uri endpoint. The browser will report violations without blocking content, letting you identify what needs to be adjusted before enforcing.

What is Permissions-Policy?

Permissions-Policy (formerly Feature-Policy) controls which browser features a page can use, such as camera, microphone, geolocation, and autoplay. Restricting unnecessary features reduces the attack surface and protects user privacy.