Security Header Checker
Server requestCheck which HTTP security headers a public URL sends, and get plain-language notes on each. Reuses the same SSRF-safe fetch as the HTTP Header Checker.
How to read the results
Each header shows a status: Present, Missing, Weak (present but with a risky setting such as unsafe-inline or a wildcard), Informational, or Not applicable. The count is a configuration summary, not a security grade.
Not a certification
A high count does not certify a site as safe, and a low count does not mean it is unsafe. Use this as a checklist alongside a full security review.
Data source: Server-side fetch. Only response headers are inspected; the body is not downloaded. Learn about our data sources →
Frequently asked questions
Does a full score mean my site is secure?
No. These headers are one layer of defense. A site can have every header and still be vulnerable, or lack some headers and still be well protected. Treat this as a configuration checklist, not a security certification.
Why is X-XSS-Protection marked informational?
Modern browsers ignore it, and it could even cause issues historically. Its absence is fine; a strong Content-Security-Policy is the current recommendation.
Could adding these headers break my site?
Yes — an overly strict CSP or CORP/COEP can block legitimate resources. Test changes carefully in staging.