🛡️ Security Headers
Security Headers Checker
Audit your HTTP security headers — CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and more. Get a grade and fix recommendations.
Audit your HTTP security headers — CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and more. Get a grade and fix recommendations.
Security headers are HTTP response headers that instruct browsers to enable or restrict specific features for security purposes. They protect against common attacks like cross-site scripting (XSS), clickjacking, MIME-type sniffing, and protocol downgrade attacks. They're one of the easiest security wins for any website.
HSTS is a header that tells browsers to always use HTTPS when connecting to your site, even if the user types http://. This prevents SSL stripping attacks. The recommended value is max-age=31536000; includeSubDomains; preload which enforces HTTPS for one year including all subdomains.
A Content Security Policy is a header that tells browsers which sources of scripts, styles, images, and other resources are allowed to load on your page. A properly configured CSP is the most effective defence against cross-site scripting (XSS) attacks. Use our CSP Generator to build one.
Aim for a grade A, which requires at minimum: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy. Adding Permissions-Policy, COOP, and COEP will strengthen your score further. Most production sites should score B or above.
Every website should implement these security headers: Strict-Transport-Security (HSTS) to enforce HTTPS, Content-Security-Policy (CSP) to prevent XSS attacks, X-Frame-Options to prevent clickjacking, X-Content-Type-Options to prevent MIME sniffing, and Referrer-Policy to control referrer information. Use InfiniUm Tools Security Headers Checker to see which ones your site is missing.
Security headers are added at the server level. For Nginx, add headers in your server block: add_header Strict-Transport-Security "max-age=31536000" always. For Apache, use Header always set in your .htaccess or config file. For Cloudflare, add Transform Rules. After adding headers, use this tool to verify they are configured correctly.