Security Headers Checker
Analyze HTTP security headers and get a security grade for your website. Check CSP, HSTS, X-Frame-Options, and more.
Content-Security-Policy (CSP): Helps prevent XSS attacks by specifying trusted sources for content. Define allowed sources for scripts, styles, images, and other resources.
Strict-Transport-Security (HSTS): Forces browsers to only use HTTPS connections, preventing downgrade attacks and cookie hijacking. Should include max-age directive.
X-Frame-Options: Prevents clickjacking attacks by controlling whether your site can be embedded in frames. Values: DENY, SAMEORIGIN, or ALLOW-FROM.
X-Content-Type-Options: Prevents MIME-sniffing attacks by forcing browsers to respect declared content types. Should be set to "nosniff".
Referrer-Policy: Controls how much referrer information is sent with requests. Helps protect user privacy and sensitive information in URLs.
Permissions-Policy: Controls which browser features and APIs can be used. Helps reduce attack surface by disabling unnecessary features.
X-XSS-Protection: Legacy header for older browsers. Enables the browser's XSS filter. Modern browsers prefer CSP instead.