HTTP security headers checker
See which security headers your homepage sends: HSTS, X-Content-Type-Options, framing protection and Content-Security-Policy, plus whether it announces a server or PHP version.
What the words mean
- Security headers
- Short instructions your site sends to the browser along with each page. Visitors never see them.
- HSTS (Strict-Transport-Security)
- Tells browsers to always use the secure https version of your site, and never the plain http one.
- X-Content-Type-Options
- Tells browsers not to guess what type a file is. Technical people call that guessing MIME sniffing.
- Framing or clickjacking protection (X-Frame-Options)
- Stops other sites showing your pages inside their own, which can be used to trick people into clicking something.
- Content-Security-Policy (CSP)
- A list telling browsers where your pages may load scripts and styles from. Anything else gets refused, which limits the harm a bad script can do. Technical people call that kind of script XSS.
- Server or PHP version
- Your site says exactly which software version it runs. Hiding that gives strangers less to go on.
How this works
We read the response headers from one ordinary request for your homepage. Each missing one comes with the line to add.
A missing header is a weakness, not a sign you've been hacked. Add Content-Security-Policy in report-only mode first, because a strict policy can break a page.
What it can't tell you
Headers are per response, and we look at the homepage only. Other pages can behave differently. If bot protection answers instead of your site, those headers aren't yours, so we report them as unknown.
Guides
Next steps
Want this checked every 5 minutes? How monitoring works.
Rather not fix it yourself? We quote per job.