Loading tool…
Loading tool…
Loading tool…
Inspect any website’s HTTP security headers, server version disclosure, and clickjacking protection with an instant A+ to F security grade.
Server processing powers this tool. Check the details below before you begin.
Loading tool…
Here’s how to get the most out of security headers checker.
Modern web browsers support powerful defensive headers—such as Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options, and X-Content-Type-Options: nosniff—that stop clickjacking, MIME sniffing, and SSL stripping attacks before they reach your users.
A few things you might want to know before you start.
Strict-Transport-Security (HSTS) and Content-Security-Policy (CSP) carry the highest security impact against protocol downgrade and script injection attacks.
No—Apache blocks direct requests to .ht* files by default, and Nginx does not use .htaccess. Instead, this tool verifies the live HTTP headers that your server actually sends.
No. Security headers add only a few hundred bytes to HTTP response headers and have zero negative impact on page speed.
Use our linked .htaccess Generator or Nginx Config Generator to copy ready-to-use header directives.
