CSP
Control scripts and resource origins.
HTTP Security Headers Checker
HTTP Security Headers Checker
Check CSP, HSTS, clickjacking, MIME sniffing and browser permission policies.
Example: The tool reads public headers from the final response. It does not execute page scripts or store history.
Security headers result
No check started
Enter a page URL, then click Check headers.
HTTP SECURITY
What are HTTP security headers?
HTTP security headers are browser-enforced rules sent with a server response. They can restrict script sources, enforce HTTPS, prevent unauthorized framing, and reduce MIME confusion and referrer-data exposure.
Headers do not replace secure coding, dependency updates or vulnerability fixes, but they add a useful enforcement boundary in the browser.
HSTS
Keep browser traffic on HTTPS.
Browser controls
Reduce framing, MIME and permission risks.
Why should site owners check security headers?
CDNs, reverse proxies, application frameworks and origins can all add or override headers. A deployment change can silently remove CSP, HSTS or framing protection, so the public final response needs regular verification.
Limit front-end injection impact
CSP restricts scripts and resources, reducing the execution space available after an XSS flaw.
Protect HTTPS and framing
HSTS reduces downgrade exposure while frame-ancestors blocks unauthorized embedding.
Align edge and origin settings
Inspect the final public response to find differences across CDN, proxy and application layers.
How does the security headers checker work?
The tool safely requests a public page, follows controlled redirects and analyzes six core header groups on the final response.
- 01
Validate the public target
Block local, private and reserved addresses, resolving again after every redirect.
- 02
Read the final response
Record status, response IP, redirects and the security headers actually delivered.
- 03
Analyze policy strength
Check CSP sources, HSTS duration, framing controls and standardized values.
- 04
Produce implementation steps
Separate missing and weak settings while preserving important deployment cautions.
How to read the security-header score
The score compares these six configurations; it is not a vulnerability scan or a search-ranking score. Fix HTTP, CSP, HSTS, framing and nosniff gaps first, then tighten policies around real application needs.
A / B
Core controls are mostly complete; verify that policies still match actual resources and workflows.
C / D
Some headers are present, but important gaps or weak settings remain.
F
Most core controls are missing or the page still uses HTTP; establish a baseline first.
HTTP security headers FAQ
Do security headers directly improve SEO rankings?+
There is no evidence that CSP or Permissions-Policy alone raises rankings. HTTPS, reliable access and fewer security incidents support long-term crawlability and trust, but headers are not a ranking trick.
Why not copy the strictest CSP immediately?+
An overly strict policy can break payments, sign-in, analytics, ads and third-party resources. Start with Report-Only, introduce nonces or hashes, and enforce gradually.
Should HSTS preload be enabled immediately?+
No. Preload has long-lived effects and is difficult to undo quickly. Confirm that the main domain and every subdomain will support HTTPS permanently before applying.
Should I use X-Frame-Options or frame-ancestors?+
Modern browsers prefer CSP frame-ancestors, which supports precise allowed origins. Keep DENY or SAMEORIGIN as a legacy fallback when needed.
Why is a missing Permissions-Policy reported?+
It is a defense-in-depth and least-privilege control, not proof of an active vulnerability. Restrict capabilities according to the features the site actually uses.
Related webmaster tools
Continue with SSL, page response, metadata and blacklist checks.
SSL/TLS certificate checker
Check certificate validity, hostname, trust chain and TLS protocol.
HTTP status & redirect checker
Check final status, redirect chains and search-related headers.
Meta & social preview checker
Check search snippets, Open Graph and Twitter Cards.
Blacklist checker
Check domain or IP reputation database signals.