About this tool
The checker sends one GET request to the URL (without following redirects), records the status line and headers, and stops before downloading the page body. It then reviews the headers that affect security.
How to read the results
Security headers are observations, not a grade. Whether a header is needed depends on the site: an API does not need a frame policy; a CSP has to be written for each site. Items are marked:
- OK — set in a sensible way.
- Consider — missing or weak; usually worth fixing on sites with logins or personal data.
- Info — worth knowing, low risk.
Cookie values are hidden; only names and attributes are shown.
Limitations
- Only ports 80 and 443 and public addresses are allowed. Redirects are not followed — use the redirect checker.
- Servers may send different headers to browsers, to other countries or on different pages. One request shows one response.
- The request identifies itself as this tool; sites behind bot protection may answer with a challenge page instead of the real headers.
Frequently asked questions
Which security headers matter most?
For most sites: Strict-Transport-Security (HTTPS only), X-Content-Type-Options: nosniff, a frame policy (CSP frame-ancestors or X-Frame-Options) and a Content-Security-Policy.
Is it bad to show the Server header?
Revealing software names is common and harmless on its own; revealing exact versions helps attackers find sites running outdated software. Hiding it is a small hardening step, not a fix.
Why does the checker show a 403 or a challenge?
Some sites block automated clients. The headers shown are what that site sends to such clients.
Do security headers affect SEO?
Not directly. They protect visitors; search engines do rank HTTPS sites, and HSTS helps make sure visitors always reach the HTTPS version.
What is HSTS?
A header telling browsers to always use HTTPS for your site.
What is a Content Security Policy?
A header listing which sources may load scripts and other content.
Are cookie values shown?
No, only cookie names and flags.