HTTP Header Security Checker

Paste your HTTP response headers to analyze security posture and get fix recommendations.

Paste HTTP Response Headers

What is HTTP Security Header Checker?

HTTP Security Header Checker analyzes the security headers of any public website. Enter a URL and the tool fetches the response headers, grades each security header (A-F), flags missing critical headers, and explains what each header does and its recommended value. Use this to audit your own site before submission to Google AdSense, before a security review, or to benchmark against best practices.

Security headers that your site should have: Content-Security-Policy (CSP), Strict-Transport-Security (HSTS), X-Frame-Options (or CSP frame-ancestors), X-Content-Type-Options: nosniff, Referrer-Policy, Permissions-Policy. Missing these headers leaves your site open to XSS, clickjacking, MIME sniffing, and SSL stripping attacks. The headers are evaluated by Mozilla Observatory, Security Headers (securityheaders.com), and similar scanning tools.

Sites that lack basic security headers can be penalized in Google search rankings (HTTPS is a ranking factor) and may be flagged by browser security warnings. Chrome flags sites without HSTS on subsequent visits if they were previously flagged as insecure. AdSense and ad networks may also consider site security in their evaluation criteria.

How to Use

  1. Enter a URL (must be publicly accessible -- https://yoursite.com).
  2. Click 'Analyze' to fetch the response headers from the server.
  3. See the security grade for each header category (A-F or Missing).
  4. Click any header row to see the current value, recommended value, and explanation.
  5. Use the 'Copy recommended .htaccess' or 'Copy Nginx config' to implement fixes.

Examples

HSTS grade A

Result: Strict-Transport-Security: max-age=63072000; includeSubDomains; preload -> A grade

Missing CSP

Result: Content-Security-Policy: not present -> F grade -> XSS risk

nosniff present

Result: X-Content-Type-Options: nosniff -> A grade -> MIME sniffing prevented

Frequently Asked Questions

What headers are checked and what is the grading criteria?

Security header scanners typically check: Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options (or CSP frame-ancestors), X-Content-Type-Options, Referrer-Policy, Permissions-Policy (formerly Feature-Policy), Cross-Origin-Opener-Policy (COOP), Cross-Origin-Resource-Policy (CORP). Grading: A+ (all headers present with recommended values), A (all required headers present), B/C (missing some recommended headers), D/E (missing important security headers), F (missing critical headers or insecure values). Missing CSP and missing HSTS are the most impactful gaps.

How do I add security headers to my website?

Nginx: in server block, add: add_header X-Content-Type-Options 'nosniff' always; add_header Strict-Transport-Security 'max-age=63072000; includeSubDomains; preload' always; add_header X-Frame-Options 'DENY' always;. Apache (.htaccess or VirtualHost): Header always set X-Content-Type-Options 'nosniff'. Express.js: use the Helmet middleware (npm install helmet) which sets 14 security headers automatically: app.use(helmet()). Cloudflare: Transform Rules -> Modify Response Header. Netlify: _headers file in deploy root. Vercel: headers array in vercel.json.

Why is Content-Security-Policy the hardest header to set correctly?

CSP requires knowing every source your page loads resources from -- scripts, styles, images, fonts, iframes. Getting it wrong blocks legitimate resources and breaks your site. Challenges: (1) Third-party scripts (Google Analytics, ads, chat widgets) need their domains added. (2) Inline scripts and styles must either use nonces (random values per request) or hashes. (3) eval() and inline event handlers are blocked by default with script-src 'strict-dynamic'. Start with CSP in report-only mode: Content-Security-Policy-Report-Only: default-src 'self' -- collect reports before enforcing.

How do I check security headers without a tool?

Command line: curl -I https://example.com (fetches only headers). grep for specific headers: curl -sI https://example.com | grep -i 'strict-transport-security'. Browser DevTools: Network tab -> click any request -> Response Headers section. Firefox shows a security tab with HTTPS and header analysis. Online tools: securityheaders.com, observatory.mozilla.org, ssllabs.com/ssltest (for TLS/certificate analysis). For programmatic access: fetch the URL server-side and inspect response.headers -- the check must be done server-to-server since CORS restricts browser access to response headers of cross-origin requests.

What is HSTS preloading and how do I enable it?

HSTS preloading registers your domain in browser preload lists -- Chrome, Firefox, Safari, Edge all include these lists. Preloaded domains get HTTPS enforcement from the very first visit (before any HSTS header is received). Requirements for preloading: valid HTTPS certificate, HSTS header with max-age >= 31536000 (1 year), includeSubDomains directive, preload directive. Submit at hstspreload.org. Warning: preloading is difficult to undo -- if your site later needs HTTP (broken cert, subdomain issues), removal from preload lists takes months. Only preload when you are certain about long-term HTTPS commitment.

Related Tools