Free website security headers checker
Check the security headers a website sends: the settings that tell browsers to always use HTTPS, block clickjacking and limit what injected code can do.
What it checks
HTTPS only
Whether http:// sends visitors to https://, and whether Strict-Transport-Security tells browsers to stay on HTTPS.
Content-Security-Policy
Whether the site limits where scripts, styles and frames may load from.
Clickjacking
Whether other sites can show it inside a frame (X-Frame-Options or frame-ancestors).
Other headers
X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
Giveaways
Server and X-Powered-By headers that reveal software versions.
Questions
What are security headers?
Instructions a website sends with every page that tell the browser how to protect visitors: always use HTTPS, do not let other sites frame the page, and only run scripts from approved places.
Which page does it check?
The home page at https:// and the name you enter, following redirects to the final page. It also checks whether the plain http:// address sends visitors to https://.
How do I add the missing headers?
In the web server or hosting settings: nginx add_header, Apache Header set, IIS custom headers, or a security plugin or CDN setting on hosted platforms. Test after each change, because a strict Content-Security-Policy can block parts of a site.
Is anything stored?
No. The site is checked and the answer is shown to you; the checker does not save or log it.
Also free: Free SSL certificate checker · Free email security checker · Free DNS lookup · All free tools
Check every customer, every day
TechSavve RMM checks websites, DNS, mail and certificates for every customer directly from the platform, alongside agentless monitoring of their devices.