What gets checked
HSTS, CSP (including report-only distinction), X-Content-Type-Options, frame controls, Referrer-Policy, and Permissions-Policy — reported as observed or not observed, without a fake numeric score.
HTTP Security Headers Checker
Check public response headers for HSTS, CSP, frame protection, and related policies on a site you operate.
A restricted public request may be sent for a normalized URL only. Cookies and credentials are never submitted. Loading tool…
Need help hardening a public website or CDN configuration?
Header policy only helps when it matches how the site is actually served through proxies and CDNs.