🆓 Free tool · 3 runs per day without registration

HTTP Headers

Audit security HTTP headers: HSTS, CSP, X-Frame-Options, Referrer-Policy.

HTTP Headers Check: free audit of HTTP security headers

HTTP Headers Check is a free tool that inspects a website's HTTP response headers and verifies the presence and correct configuration of security headers: HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. It returns a score and flags missing or weak headers.

What security headers are for

HTTP security headers are a website's first line of defense against common attacks such as cross-site scripting (XSS), clickjacking and MIME sniffing. Configuring them correctly is a hardening best practice required by security audits, penetration tests and compliance standards. This tool tells you instantly what is missing.

How HTTP Headers Check works

Enter a site URL and the tool performs an HTTP request, reads the final response headers (following redirects) and compares them against OWASP best practices. It also flags information-disclosure headers such as Server and X-Powered-By that reveal the backend technology.

100% free tool: 3 analyses per day with no sign-up, 50 per session with a free account. No installation required.