Security Headers Checker
Fetches a domain and inspects its response for the six HTTP security headers browsers rely on for defense-in-depth: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. Each missing or misconfigured header comes with a plain-English explanation of exactly what it protects against — no jargon-only output. Part of ForgePlug's Site Health Check, which also runs SSL, DNS, and robots.txt checks on the same domain at no extra cost.
This check runs server-side — ForgePlug briefly connects to the domain you enter to read its certificate, DNS records, response headers, and robots.txt/sitemap. We don't store anything beyond a 5-minute result cache (to avoid re-running the same check for everyone hitting a trending domain) and a short-lived snapshot used to compare a re-check later.
The six headers this scanner checks, and what each one stops
Plain-English explanations, not just a list of names.
- Strict-Transport-Security — forces browsers to use HTTPS on every future visit, closing the window for downgrade/man-in-the-middle attacks on public Wi-Fi.
- Content-Security-Policy — restricts which scripts and resources a page is allowed to load, limiting the damage if an XSS bug ever gets injected.
- X-Frame-Options — stops your site from being loaded inside an invisible iframe on another site and used for clickjacking.
- X-Content-Type-Options — stops browsers from guessing (MIME-sniffing) a file's type, which can otherwise turn an innocuous upload into executable script.
- Referrer-Policy — controls how much of your URL (which can contain tokens or query data) leaks to third-party sites via the Referer header.
- Permissions-Policy — explicitly restricts which browser features embedded content is allowed to request, like camera, microphone, or geolocation.
Because it's part of ForgePlug's full Site Health Check, submitting also runs a TLS certificate check, a DNS propagation check, and a robots.txt/sitemap validation on the same domain — all in parallel, at no extra cost.
Frequently Asked Questions
HTTP security headers, explained
Which six headers does this check for?
My header is present — why is it still flagged?
Which header should I add first if I only do one?
Why did adding a Content-Security-Policy break my site?
Do I need X-Frame-Options if I already have a CSP?
What does Referrer-Policy actually leak without it?
Is this really free, and is there a limit?
Why does this tool need a server? Aren't ForgePlug's tools all browser-based?
What do you do with the domain I check?
Guides & Articles
Learn how to get the most out of this tool with our in-depth guides.
Tool Overview
A closer look at Security Headers Checker — how it works, who it's for, and where it fits in your workflow.
HTTP security headers are instructions your server sends with every response telling the browser what it is allowed to do with the page. They cost nothing to send, they are invisible to users, and they are the cheapest defensive measure available — which is precisely why they are so often left unset. Nothing breaks when they are missing. There is no error, no warning, no failing test. The protection is simply absent, and stays absent until someone checks.
Each of the six covers a different attack. Strict-Transport-Security tells the browser to refuse plain HTTP for your domain entirely, closing the window where a first request over HTTP can be intercepted and redirected. Content-Security-Policy restricts where scripts, styles, and frames may load from, which is the strongest single mitigation against cross-site scripting. X-Frame-Options (and its modern replacement, CSP's frame-ancestors) stops your pages being embedded in someone else's site to trick users into clicking things — clickjacking. X-Content-Type-Options: nosniff stops the browser second-guessing a declared content type, which is how an uploaded file can end up executed as a script. Referrer-Policy controls how much of the current URL leaks to third parties in the Referer header, which matters when your URLs contain tokens or identifiers. Permissions-Policy switches off browser features — camera, microphone, geolocation — that your page has no reason to use.
Presence alone is not the same as protection, and this is the part most quick checks miss. A Strict-Transport-Security header with max-age=0 is syntactically valid and completely inert — it actively tells the browser to forget the policy. An X-Frame-Options value other than DENY or SAMEORIGIN is ignored by modern browsers, so a creative custom value leaves you unprotected while looking configured. Both are common copy-paste results, and both are flagged here rather than counted as a pass.
The check fetches your domain and reports each of the six as present, missing, or present-but-misconfigured, with what the header actually does in plain terms. It is a starting point for hardening rather than a compliance audit — a strong CSP in particular takes iteration, because the first version almost always blocks something your own site depends on.
Key Features
Everything you get with this tool, at a glance.
All six headers in one pass
HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.
Catches inert configurations
Flags max-age=0 HSTS and invalid X-Frame-Options values that look set but do nothing.
Shows the actual value
Reports what your server sent, not just whether the header name was present.
Explains the attack each one blocks
Every result says what it defends against, so the fix has a reason attached rather than a checklist tick.
Checks the live response
Reads headers from a real request, so CDN or proxy layers that strip or add headers are reflected.
Prioritised, not exhaustive
Focuses on the six that materially matter rather than listing every header ever proposed.
How to Use Security Headers Checker
Get from zero to done in four quick steps — no account, no learning curve.
Check the URL users actually land on
Headers can differ between apex and www, between HTTP and HTTPS, and between a CDN edge and your origin. Test the address real traffic hits.
Start with HSTS and nosniff
These two are effectively free — a fixed value with no per-site tuning and almost no chance of breaking a working site. Set them first.
Treat CSP as an iterative project
Deploy Content-Security-Policy in report-only mode first and watch what it would have blocked. Enforcing a first-draft policy on a live site reliably breaks analytics, embeds, or inline styles.
Verify a header is doing something
If a header is reported as present but misconfigured, treat it as absent. max-age=0 and an unrecognised X-Frame-Options value provide no protection at all.
Re-check after CDN changes
Proxies and CDNs can add or strip headers independently of your origin config, so a change at that layer is worth verifying from outside.
Practical Examples
Real input and output pairs so you know exactly what to expect.
Well-configured site
Input
github.com
Output
Pass — HSTS with a long max-age, a Content-Security-Policy present, framing restricted, and nosniff set.
Header present but inert
Input
A site sending Strict-Transport-Security: max-age=0
Output
Flagged — the header is syntactically valid but instructs the browser to discard the policy, so HTTPS is not enforced.
No headers configured
Input
A default server with no header configuration
Output
All six reported missing, with the specific attack each one would have mitigated.
Guides & Articles
Learn how to get the most out of this tool with our in-depth guides.
Was this tool helpful?
Your feedback helps us improve Security Headers Checker for everyone.
Share this tool