Free tool
Security headers test
Analyse the HTTP headers that protect your visitors, get a grade and concrete advice for every missing header.
Get an explained alert as soon as something changes. Monitor it for free
What are these headers for?
Security headers tell the browser how to protect your visitors. They cost nothing and block common attacks.
- Strict-Transport-Security (HSTS): enforces HTTPS and prevents downgrade attacks.
- Content-Security-Policy (CSP): restricts allowed scripts and reduces the impact of XSS flaws.
- X-Frame-Options or frame-ancestors: prevents your site from being framed (clickjacking).
- X-Content-Type-Options: stops the browser from guessing file types.
- Referrer-Policy: limits the information sent to other sites.
- Permissions-Policy: disables unneeded sensitive features (camera, microphone, geolocation).
How the grade is computed
Every header present adds points, the most important ones (HSTS and CSP) count more. The grade goes from A (excellent) to F (no protection).
Other free tools
Is it down?
Check whether a website responds, from our servers, with every step detailed.
SSL checker
Expiry date, issuer and validity of a website’s HTTPS certificate.
Domain expiry
Expiry date and registrar of a domain name (RDAP).
DNS lookup
A, AAAA, CNAME, MX, TXT, NS and CAA records of a domain.
Blacklist check
Check an IP or a domain (and its mail servers) on Spamhaus, Barracuda, SpamCop and other lists.