No Login Data Private Local Save

HTTP Security Header Checker - Online HSTS, CSP, X-Frame Analysis

21
0
0
0

HTTP Security Header Checker

Analyze HSTS, CSP, X-Frame-Options & more in seconds. Detect missing security headers and fix your website’s configuration.

Enter a full URL (e.g., https://yourwebsite.com) to scan its security headers.
Security Header Status Value / Recommendation Risk

Frequently Asked Questions

HSTS forces browsers to only connect to your site over HTTPS, preventing SSL stripping attacks. Missing HSTS header can leave users vulnerable to man-in-the-middle attacks.

CSP helps detect and mitigate XSS, clickjacking, and other code injection attacks. Without a strong CSP, attackers can load malicious scripts on your pages.

X-Frame-Options prevents clickjacking by controlling whether your site can be embedded in iframes. Set it to DENY or SAMEORIGIN in your web server configuration or security headers.

Modern browsers rely on CSP instead, but X-XSS-Protection can provide an additional layer against reflected XSS. Set to "0" if you have a robust CSP; otherwise "1; mode=block" is recommended.

For maximum privacy, use "no-referrer" or "strict-origin-when-cross-origin". It prevents leaking sensitive URL information to external sites.

Most headers can be set via your web server configuration (Apache .htaccess, Nginx config) or through your application code. Many CDNs and cloud platforms also provide simple toggles.
🔧 Related Tools