Which security headers does your website send?
Enter a domain to see the security headers its website sends today, and which of them the full scan would report as findings.
Last reviewed
The check reads the first page of the website.
It requests the home page over HTTPS, follows redirects, and reads the response headers, the same way the full scan does. If HTTPS does not work, it reads the headers over HTTP instead. It shows every common security header as set or missing, and the cookie flags if the page sets cookies.
Five headers and flags count as findings.
| What the check finds | Finding | Severity |
|---|---|---|
No Content-Security-Policy | Security headers missing | Medium40 |
No Strict-Transport-Security over HTTPS | HSTS header missing | Medium50 |
No X-XSS-Protection | X-XSS-Protection header missing | Medium50 |
A cookie without Secure over HTTPS | Insecure cookie configuration | Medium65 |
No cookie with HttpOnly over HTTPS | Cookies missing httponly flag | Medium60 |
X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy are shown so you can see the full picture, but the scan does not score them separately. HSTS and the cookie flags only count over HTTPS: browsers ignore HSTS over plain HTTP, and a cookie cannot be marked Secure there.
Start with HSTS and a CSP.
HSTS is one line once HTTPS works everywhere. A Content-Security-Policy takes more care, because a strict one can break scripts the page relies on: start in report-only mode, read what it would block, then enforce it. The guide to HTTP security headers has example values for each header and the order to roll them out in.
It reads one page at one point in time.
- The home page only. Other pages, apps on subdomains and API responses can send different headers.
- What the server sends today. A header added by a CDN or proxy counts, because it is what visitors receive.
- Headers, not behaviour. A CSP that is set but allows everything still clears the finding.
Headers are one part of the TLS and web security module. The free check covers all six modules in about 30 seconds.