Security Headers Analysis
HTTPS and a valid certificate are a great start, but they’re not the whole story. Security headers tell the browser how to treat your site—what can run, what can be embedded, whether to force HTTPS. We check six of the most important ones and point out what’s missing.
Headers like HSTS, Content-Security-Policy, and X-Frame-Options help ward off XSS, clickjacking, and similar issues. They’re recommended by OWASP and most security guides. Here you get a clear picture of what your domain sends and what you might want to add.
No signup, no account. Enter your domain on the homepage and the report will show you redirects, SSL, security headers, and HTTP/3 (QUIC) support in one place. We also show cookie security (Secure, HttpOnly, SameSite) and headers that may disclose server or framework (e.g. Server, X-Powered-By)—informational only, no impact on the grade. If something’s off, we suggest concrete next steps.
Critical Security
HSTS
Forces browsers to use HTTPS, preventing protocol downgrade attacks.
Content-Security-Policy
Prevents XSS attacks by controlling which resources can be loaded.
Attack Prevention
X-Frame-Options
Prevents clickjacking by controlling iframe embedding.
X-Content-Type-Options
Prevents MIME-type sniffing attacks.
Privacy & Control
Referrer-Policy
Controls referrer information sent with requests.
Permissions-Policy
Controls browser features (camera, mic, geolocation) access. The HTTP header is mainly enforced in Chromium (Chrome, Edge); Firefox, Safari, and iOS WebView often ignore it, so coverage is not uniform across browsers.