Free Security Headers Checker
Grade the security headers your site sends with every page.
No signup. We don't store or log the domains you check.
Checking domain...
That's one signal. Your site has more.
The Website Health Check covers the big picture: Google Lighthouse speed scores plus DNS, SSL, email authentication, and AI access in one report.
Run the Website Health CheckHow it works
We load the site's homepage over HTTPS and grade the security headers on the final response: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options (or its CSP replacement), X-Content-Type-Options, Referrer-Policy, and Permissions-Policy — each with a plain-language explanation of what it protects.
When to use this
After moving hosts or CDNs, since header configuration rarely survives a migration, and after any security review that names a missing header. Most of these are one-line fixes once you know they're absent.
Frequently asked questions
Which headers does this grade?
Strict-Transport-Security (HSTS), Content-Security-Policy, X-Frame-Options or its modern CSP replacement, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy — the six that cover most of what browsers can enforce for you.
My site is missing several headers. How bad is it?
Missing headers are hardening gaps, not breaches. Each one closes a specific class of attack, and most are one line of configuration on your host or CDN. Start with HSTS and X-Content-Type-Options — the easy wins — and treat Content-Security-Policy as a project rather than a toggle.
Why check headers if my site already has SSL?
SSL encrypts the connection; headers control what browsers allow once the page arrives — whether it can be framed by another site, where scripts may load from, what leaks in referrer data. They're complementary layers.
Check everything at once
One report covering speed, DNS, SSL, email authentication, and AI access — the signals that decide whether visitors, search engines, and AI assistants trust your site.
Run the Website Health Check