Audit your HTTP security headers — CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and more. Get a grade and fix recommendations.
What it checks: every major security header (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) against current best practices, with a letter grade and copy-pasteable fix snippets for Nginx and Apache.
Security headers are HTTP response headers that instruct browsers to enable or restrict specific features for security purposes. They protect against common attacks like cross-site scripting (XSS), clickjacking, MIME-type sniffing, and protocol downgrade attacks. They're one of the easiest security wins for any website.
HSTS is a header that tells browsers to always use HTTPS when connecting to your site, even if the user types http://. This prevents SSL stripping attacks. The recommended value is max-age=31536000; includeSubDomains; preload which enforces HTTPS for one year including all subdomains.
A Content Security Policy is a header that tells browsers which sources of scripts, styles, images, and other resources are allowed to load on your page. A properly configured CSP is the most effective defence against cross-site scripting (XSS) attacks. Use our CSP Generator to build one.
Aim for a grade A, which requires at minimum: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy. Adding Permissions-Policy, COOP, and COEP will strengthen your score further. Most production sites should score B or above.
Every website should implement these security headers: Strict-Transport-Security (HSTS) to enforce HTTPS, Content-Security-Policy (CSP) to prevent XSS attacks, X-Frame-Options to prevent clickjacking, X-Content-Type-Options to prevent MIME sniffing, and Referrer-Policy to control referrer information. Use InfiniUm Tools Security Headers Checker to see which ones your site is missing.
Security headers are added at the server level. For Nginx, add headers in your server block: add_header Strict-Transport-Security "max-age=31536000" always. For Apache, use Header always set in your .htaccess or config file. For Cloudflare, add Transform Rules. After adding headers, use this tool to verify they are configured correctly.
A security headers checker fetches the HTTP response headers from any URL and evaluates them against security best practices — checking for HSTS, Content Security Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.
Enter any URL into the security headers checker above and click Check. The tool makes a server-side HTTP request and analyses all response headers, rating each one as pass, warn, or fail based on OWASP recommendations — with specific fix guidance for each issue.
HSTS (HTTP Strict Transport Security) tells browsers to always use HTTPS for your site — even if the user types http://. Without it, users on insecure networks could be downgraded to HTTP before the redirect happens. Set it with: Strict-Transport-Security: max-age=31536000; includeSubDomains
Add headers to your server block and reload: add_header X-Frame-Options "SAMEORIGIN" always; add_header X-Content-Type-Options "nosniff" always; add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; Then run: sudo nginx -t && sudo systemctl reload nginx