Free tool · HTTP headers
Security headers checker
Audit HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and the cross-origin isolation headers in one go. No signup.
What this tool checks
We fetch the homepage of the domain over HTTPS and parse every response header relevant to browser-side security. The classic three (HSTS, CSP, X-Frame-Options) plus the modern set (X-Content-Type-Options, Referrer-Policy, Permissions-Policy) and the cross-origin isolation triplet (Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy, Cross-Origin-Resource-Policy).
For each header we surface what's set, score the value (presence is half - the actual directive matters more), and flag the common foot-guns - unsafe-inline in CSP, a too-short HSTS max-age, Referrer-Policy: no-referrer-when-downgrade (the browser default, not a chosen posture), etc.
We also follow up to 3 redirects so you score the actual served origin rather than a redirector. Many sites have tightly-locked headers on the redirector and lax headers on the destination - we want the destination's posture.
How to read the results
HSTS without preload protects subsequent visits but not the first. Submitting to the HSTS Preload list (with includeSubDomains and max-age ≥ 31536000) protects first visits too.
CSP with unsafe-inline is functionally equivalent to no CSP for XSS prevention. If you can't kill inline scripts, switch to nonce-based CSP - it's the only backwards-compatible path to a real CSP posture.
X-Frame-Options vs CSP frame-ancestors: CSP frame-ancestors supersedes X-Frame-Options. Both is fine but the CSP version is what modern browsers use. Some receivers (older proxies, email clients) still respect X-Frame-Options exclusively, so shipping both is the belt-and-braces choice.