Security Headers Checker
Scan your website headers for security vulnerabilities and get a security grade.
Why verify security headers?
- Prevent Cross-Site Scripting (XSS) attacks
- Protect against clickjacking on your pages
- Enforce secure connections (HTTPS-only) with HSTS
- Stop browsers from sniffing wrong content types
- Improve SEO signaling for secure websites
Last updated: February 10, 2026•Built by y4yes Tools Team
Results are generated in real-time. For best accuracy, verify critical issues manually.
What this tool checks
- ✓ Strict-Transport-Security (HSTS)
- ✓ Content-Security-Policy (CSP)
- ✓ X-Frame-Options (Clickjacking)
- ✓ X-Content-Type-Options (MIME Sniffing)
- ✓ Referrer-Policy
Common problems this tool finds
- ⚠️ Missing HSTS on HTTPS sites
- ⚠️ No protection against 'iframe' embedding
- ⚠️ Weak or missing CSP configuration
- ⚠️ Leaking user data via Referrer header
- ⚠️ Server version information exposed
How to fix results (Quick Checklist)
- 1.Enable HSTS in your server config (Apache/Nginx) or CDN (Cloudflare).
- 2.Set 'X-Frame-Options: DENY' or 'SAMEORIGIN' to stop others from embedding your site.
- 3.Implement a basic CSP to restrict script sources to trusted domains only.
- 4.Add 'X-Content-Type-Options: nosniff' to prevent MIME type confusion attacks.
When to use this tool
Launching a new website or application
After changing hosting providers or CDNs
Conducting a security audit or penetration test
Improving Mozilla Observatory scores
Ensuring compliance with security standards
Troubleshooting mixed content warnings