HTTP header checker with security headers
Every header the server sends, with the six security headers browsers expect marked.
Free, no signup, usually a few seconds.
You will see: how many of the six security headers are set, the server, caching and the full list.
Common questions
I am missing security headers. Is that urgent?
It does not take a site down, but each header closes one kind of attack: HSTS stops downgrades to http, X-Frame-Options stops the site being embedded in a foreign page, CSP limits scripts. On most platforms you add them in the server settings or a security plugin.
What is HSTS?
Strict-Transport-Security tells the browser to reach the site only over https for a period. The usual value is a year (max-age=31536000). A value that is too short is flagged here.
The Server header shows a version. Is that a problem?
Showing an exact server or language version helps an attacker pick a known hole. Hide the version. The name alone (nginx, cloudflare) is fine.
Is there a limit?
Up to 20 checks an hour from one connection, with no account. A result is kept for ten minutes, so checking the same address twice returns the saved one.