HTTP Security Headers Checker
Grade a website’s HTTP security headers, HSTS, CSP, X-Frame-Options, Referrer-Policy, cookies, from pasted headers or by fetching a public URL.
Runs on your device; optional server fetch
Result
What it does
Security headers are a quick signal of how carefully a site is run, and a useful conversation starter when offering web services to a prospect. Paste the headers from your browser’s developer tools (Network tab), or let the server fetch them for a public URL.
How to use it
- Choose paste or fetch.
- Paste response headers, or enter a public https URL.
- Review each finding.
Example
The example fills in realistic values and runs the tool. Select Try an example above to see it.
When it helps
- Auditing your own sites after deployment.
- Preparing a prospect’s website review.
- Learning what each header does.
Questions
Why can’t some URLs be fetched?
To prevent abuse, the server refuses private, local and cloud metadata addresses, nonstandard ports and non HTTP(s) schemes, and limits each visitor to a few requests per minute.
Is a missing header a vulnerability?
Not by itself. Headers are defence in depth; a site can be secure without one and insecure with all of them.
More leads & site analysis tools
See all 6- UTM Campaign Link Builder Build Google Analytics UTM-tagged campaign URLs with source, medium, campaign, term and content, normalised to lowercase so reports stay clean.
- Lead Scoring Calculator Score a sales lead from 0 to 100 using your own weighted criteria such as budget, authority, need and timeline, and get a hot, warm or cold rating.
- Contact List CSV Cleaner Clean a contacts CSV: remove duplicate emails, trim spaces, fix name capitalisation and drop invalid addresses, with spreadsheet safe output.
- Email Address Syntax Validator Check a list of email addresses for syntax errors, common domain typos (gmial.com), disposable providers and role based addresses before you send.
People also use
Browse all 200 tools- Microphone Test Test your microphone online in seconds: see a live level meter, choose between microphones, and play back a short recording to hear yourself. Device tests
- JWT Decoder Decode a JSON Web Token header and payload, convert iat, nbf and exp to readable dates, and see whether it has expired. Tokens stay on your device. Developer
- Markdown to HTML Converter Convert GitHub flavoured Markdown (tables, task lists, fenced code) into clean HTML you can paste into a CMS or email template. Text & writing
- Age Calculator Calculate exact age in years, months and days from a date of birth, plus total days and weeks lived and days until the next birthday. Everyday