HTTP Security Header Checker

What are HTTP security headers?

Every time a browser requests a page, the server responds with HTTP headers before the actual HTML arrives. Most of these headers are mundane. Content type, cache duration, encoding. But a handful of them act as security directives that fundamentally change how the browser treats your content.

Content-Security-Policy tells the browser exactly which scripts, styles, and resources are allowed to load. See the full specification at MDN. Without it, any injected <script> tag runs with full privileges. Strict-Transport-Security forces HTTPS and prevents SSL-stripping attacks. X-Frame-Options blocks clickjacking by refusing to render your page inside an iframe on a malicious domain.

The problem? These headers are opt-in. Servers don't send them by default. The OWASP Secure Headers Project documents best practices for each one. If your Nginx config, Apache .htaccess, or Express middleware doesn't explicitly set them, they simply don't exist in the response. And the browser falls back to its most permissive behavior. That gap is exactly what attackers exploit.

Our checker sends a real HTTP request to your URL, parses every response header, and flags what's missing. Read our complete guide to HTTP security headers for an in-depth walkthrough.

Headers we check

The tool evaluates seven security-critical headers and flags information-leaking headers that expose your server stack.

Need to build a CSP from scratch? Try our visual CSP generator with platform presets for Next.js, WordPress, and React.

How to fix missing security headers

The exact syntax depends on your web server or framework. Below are copy-paste examples that add all seven headers. Adjust the CSP directive values to match your actual resource origins. The examples use a strict baseline.

server {
    # Prevent XSS. Restrict resource origins
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-ancestors 'self';" always;

    # Force HTTPS for 1 year, include subdomains
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

    # Block framing (legacy fallback for CSP frame-ancestors)
    add_header X-Frame-Options "SAMEORIGIN" always;

    # Prevent MIME-type sniffing
    add_header X-Content-Type-Options "nosniff" always;

    # Limit referrer data to same-origin
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    # Disable unnecessary browser features
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;

    # Isolate browsing context
    add_header Cross-Origin-Opener-Policy "same-origin" always;

    # Hide server version
    server_tokens off;
}

<IfModule mod_headers.c>
    Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-ancestors 'self';"
    Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
    Header set X-Frame-Options "SAMEORIGIN"
    Header set X-Content-Type-Options "nosniff"
    Header set Referrer-Policy "strict-origin-when-cross-origin"
    Header set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()"
    Header set Cross-Origin-Opener-Policy "same-origin"

    # Remove server info headers
    Header unset Server
    Header unset X-Powered-By
</IfModule>

import helmet from "helmet";

app.use(
  helmet({
    contentSecurityPolicy: {
      directives: {
        defaultSrc: ["'self'"],
        scriptSrc: ["'self'"],
        styleSrc: ["'self'", "'unsafe-inline'"],
        imgSrc: ["'self'", "data:"],
        fontSrc: ["'self'"],
        connectSrc: ["'self'"],
        frameAncestors: ["'self'"],
      },
    },
    strictTransportSecurity: {
      maxAge: 31536000,
      includeSubDomains: true,
      preload: true,
    },
    frameguard: { action: "sameorigin" },
    referrerPolicy: { policy: "strict-origin-when-cross-origin" },
    crossOriginOpenerPolicy: { policy: "same-origin" },
    // helmet strips X-Powered-By automatically
  })
);

// next.config.js
const securityHeaders = [
  { key: "Content-Security-Policy", value: "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-ancestors 'self';" },
  { key: "Strict-Transport-Security", value: "max-age=31536000; includeSubDomains; preload" },
  { key: "X-Frame-Options", value: "SAMEORIGIN" },
  { key: "X-Content-Type-Options", value: "nosniff" },
  { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
  { key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=(), payment=()" },
  { key: "Cross-Origin-Opener-Policy", value: "same-origin" },
];

module.exports = {
  async headers() {
    return [{ source: "/(.*)", headers: securityHeaders }];
  },
};

Security header grading

The tool assigns a letter grade from A to F based on a weighted scoring system. Not all headers are equal. CSP and HSTS carry significantly more weight because they protect against the broadest and most damaging attack categories (XSS and SSL stripping, respectively).

Information-leaking headers (Server, X-Powered-By, X-AspNet-Version) incur score penalties even when all security headers are present. Removing them can push a B+ into an A.

Common header mistakes

Setting headers incorrectly can be worse than not setting them at all. It gives a false sense of security. These are the mistakes we see most often.

Frequently asked questions

Related tools