Free tools / Security Headers Checker
Security headers checker
Enter a website to see which of the six key HTTP security headers its server sends, and what each missing one protects against. These are one-line server settings, so fixing them is usually quick. Security scanners, penetration tests and some enterprise clients check for them.
Questions
Which security headers matter most?
Strict-Transport-Security (forces HTTPS) and Content-Security-Policy (limits which scripts can run) give the most protection. X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy are smaller wins that are very easy to add.
Will adding security headers break my site?
Most are safe to add as-is. Content-Security-Policy is the exception: a strict policy can block your own scripts, so start with it in report-only mode and tighten it gradually.
Where do I add security headers?
In your server or hosting configuration: for example .htaccess on Apache, the server block on Nginx, a plugin on WordPress, or the headers settings in Cloudflare, Vercel or Netlify.
Want the whole picture?
This checks one thing. The full audit runs every check on speed, SEO, mobile and security, adds AI readiness, ranks the fixes by impact and gives you a copy-paste AI prompt for each one. Free, no signup.
More free tools
- SSL Certificate Checker — When does a site's SSL certificate expire, and who issued it?
- Domain Expiry Checker — When does a domain's registration run out?
- AI Crawler Checker — Can ChatGPT, Claude and Perplexity read a site?
- Meta Tag Checker — How does a page look in Google and when shared?