Security Headers Checker

Analyze HTTP security headers and get recommendations

Important Security Headers

CSPContent Security Policy
HSTSHTTP Strict Transport
X-FrameClickjacking Protection
X-XSSXSS Protection
X-ContentMIME Type Sniffing
ReferrerReferrer Policy

Security Headers Checker: Complete Guide to HTTP Security Headers

HTTP security headers are essential for protecting your website and users from various attacks including XSS, clickjacking, MIME-type sniffing, and man-in-the-middle attacks. Our free security headers checker analyzes your website's headers and provides actionable recommendations to improve security.

Essential Security Headers Explained

Content-Security-Policy (CSP)

Prevents XSS attacks by specifying which content sources are allowed. Controls scripts, styles, images, fonts, and other resources.

Strict-Transport-Security (HSTS)

Forces browsers to use HTTPS only, preventing protocol downgrade attacks and cookie hijacking.

X-Frame-Options

Prevents clickjacking by controlling whether your site can be embedded in iframes on other domains.

X-Content-Type-Options

Prevents MIME-type sniffing by forcing browsers to respect the declared Content-Type header.

Understanding Security Grades

  • A+
    Excellent: All essential security headers properly configured
  • A
    Very Good: Most security headers present with good configuration
  • B
    Good: Basic security headers present, some improvements needed
  • C
    Fair: Minimum security, missing important headers
  • D/F
    Poor: Critical security headers missing, immediate action needed

Common Security Vulnerabilities Prevented

  • Cross-Site Scripting (XSS) - Blocked by CSP and X-XSS-Protection headers
  • Clickjacking - Prevented by X-Frame-Options and CSP frame-ancestors
  • MIME-Type Confusion - Stopped by X-Content-Type-Options: nosniff
  • Protocol Downgrade - Prevented by HSTS forcing HTTPS connections
  • Information Leakage - Controlled by Referrer-Policy header
  • Feature Abuse - Managed by Permissions-Policy (formerly Feature-Policy)

Recommended Header Configuration

# Essential Security Headers (Apache)
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set X-Content-Type-Options "nosniff"
Header always set X-XSS-Protection "1; mode=block"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'"

Frequently Asked Questions

How do I add security headers to my website?

Security headers can be added through your web server configuration (Apache, Nginx, IIS), your application code, or a CDN like Cloudflare. The method depends on your hosting setup and the level of control you have.

Will adding security headers break my website?

Some headers like CSP can break functionality if misconfigured. Start with a report-only mode (Content-Security-Policy-Report-Only) to identify issues before enforcing. Other headers like HSTS, X-Frame-Options are generally safe to add immediately.

What is the most important security header?

Content-Security-Policy (CSP) is often considered the most important as it provides comprehensive protection against XSS and data injection attacks. However, HSTS is critical for HTTPS enforcement. Both should be prioritized.

How often should I check my security headers?

Check after any server configuration changes, CMS updates, or when deploying new features. Monthly checks are recommended as part of routine security maintenance. Set up automated monitoring for critical sites.