Security Headers Checker
Check for HSTS, Content-Security-Policy, framing protection and other headers that defend visitors.
Este contenido está en inglés.
Ejemplos resueltos
Checking a brochure site
https://example.com entered in the address box
Headers found: Strict-Transport-Security, X-Content-Type-Options. Headers not found: Content-Security-Policy, X-Frame-Options, Referrer-Policy, Permissions-Policy. The page shows a coverage score for the headers checked.
This is an illustrative report; a missing header is a prompt to review the setting, not proof of a security problem.
Confirming a header after a change
Same site checked again after adding X-Frame-Options to the server settings
Headers found: Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options. The score rises by one header compared with the earlier check.
Rechecking after each server change confirms the new header is actually sent to visitors.
Sobre Security Headers Checker
A security headers checker reads the HTTP response headers that your server sends with each page and compares them against common security recommendations. It grades the site from A to F, covering headers such as HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy. Each grade reflects which protections are present and set correctly, not a full audit of your code.
Security headers are instructions that tell browsers how to handle your pages, whether to use HTTPS only, whether other sites may frame them, or which scripts may run. The checker also flags headers that disclose server software or version details, which can help an attacker profile a site. A high grade is a useful starting point, but it does not guarantee that a site is safe from every vulnerability.
Cómo usar Security Headers Checker
- Enter the full address of the page you want to test, including https://.
- Wait for the grade and header report to appear.
- Check any missing headers, starting with HSTS and Content-Security-Policy.
- Hide or remove headers that reveal server software or version numbers.
- Update your server or application settings, then test again.
Usos habituales
- Checking a new website against basic header recommendations before launch
- Auditing a site after a hosting or server change
- Spotting version details revealed by default server headers
- Comparing headers across several sites you manage
Preguntas frecuentes
What is a good security headers score?
An A grade means the headers this checker tests are present and set to recommended values, which is a strong result for those specific checks. A grade below A usually points to a missing header, such as HSTS or Content-Security-Policy, or to a header with a weak value. The grade covers only the headers listed, so it says nothing about application code, authentication or server patching.
What does HSTS do?
HTTP Strict Transport Security, or HSTS, tells browsers to connect to a site only over HTTPS for a set period, given in seconds by the max-age value. This reduces the risk of downgrade attacks and accidental plain HTTP connections. Enable it only once every subdomain supports HTTPS, because a wrong setting can make parts of a site unreachable for returning visitors.
Should I hide the Server header?
Hiding the Server header makes it harder to see which software and version a site runs, which removes one easy piece of information for scanners. It is a minor hardening step rather than a fix for weak software, so keep the underlying software updated too. Some servers can only partly hide this detail, so check the result after each change.
Do security headers stop cross-site scripting?
A well-configured Content-Security-Policy can greatly reduce the impact of cross-site scripting by limiting which scripts a page may load and run. Other headers, such as X-Content-Type-Options and X-Frame-Options, guard against different risks, including MIME sniffing and clickjacking. Headers help, but they are only one layer, and input validation and output encoding remain essential.
What is the difference between X-Frame-Options and Content-Security-Policy?
X-Frame-Options controls whether other sites can embed your page in a frame, which helps prevent clickjacking. Content-Security-Policy offers similar control through its frame-ancestors directive, and it also sets rules for where scripts, styles and images can load from. Modern browsers give frame-ancestors precedence, so many sites set both for wider compatibility.