Server
sysadmin.lk

Security Headers Checker

Check for HSTS, CSP, X-Frame-Options, and other security-relevant HTTP response headers.

What are HTTP security headers?

Reviewed by Prabath Thalangama · Last updated

HTTP security headers are response headers that tell browsers how to protect visitors: force HTTPS, block clickjacking, stop MIME sniffing, limit referrer leakage and control which scripts may run. This checker fetches your page and reports which of nine recommended headers are present, with a score and the fix for each missing one.

Five headers are treated as important and cost points when missing: Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options, X-Content-Type-Options and Referrer-Policy. Permissions-Policy and the cross-origin isolation headers (COOP, COEP, CORP) are reported for information without affecting the score.

The check looks for each header's presence. A header with a weak value, such as a CSP that allows 'unsafe-inline' scripts, still counts as present, so review the values as well.

How do I check my website's security headers?

  1. Enter the full URL or host name of the page to test.
  2. Read which headers are missing and the score.
  3. Add the missing headers in your web server, CDN or application, then test again.

How to read the results

Score
Starts at 100 and loses 15 points for each missing important header.
Headers
Each of the nine headers, whether the response includes it, and its value when present.
Findings
One finding per missing header: a warning for the five important ones, information for the rest.

How to add the missing headers

Nginx

Add the headers in the server block. The always parameter makes nginx send them on error pages too. add_header inside a location block replaces, rather than adds to, the server-level ones.

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
add_header Content-Security-Policy "default-src 'self'; frame-ancestors 'self'" always;

Apache

Enable mod_headers and add the headers to the virtual host.

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set Referrer-Policy "strict-origin-when-cross-origin"

Content-Security-Policy breaks the site

Roll out CSP in report-only mode first with Content-Security-Policy-Report-Only, fix the violations it reports in the browser console, then switch to the enforcing header.

HSTS locks out a subdomain

includeSubDomains forces HTTPS on every subdomain. Only add it, and preload, once every subdomain serves valid HTTPS.

Examples and command-line equivalents

See a site's response headers

curl -sI https://example.com

# Only the security-related ones
curl -sI https://example.com | grep -iE 'strict-transport|content-security|x-frame|x-content-type|referrer-policy|permissions-policy'

Frequently asked questions

Is X-Frame-Options still needed if I have CSP?

CSP's frame-ancestors directive replaces X-Frame-Options in modern browsers. Sending both is harmless and covers older clients.

Do security headers help SEO?

Not directly as ranking factors, apart from HTTPS itself. They protect visitors and your site's reputation, and HSTS removes an extra HTTP-to-HTTPS redirect for returning visitors.

What about X-XSS-Protection?

It is obsolete. Modern browsers have removed the XSS auditor it controlled, so it is not checked. Use Content-Security-Policy instead.

Further reading

More Website tools

All Website tools →