Free HTTP Security Header Checker & Analyzer

HTTP security headers are response headers that web servers send to browsers, instructing them how to handle the page content securely. They protect against common web attacks like clickjacking, cross-site scripting (XSS), content injection, and data leakage without requiring changes to your application code.

HSTS (HTTP Strict-Transport-Security) tells browsers to only connect to your site over HTTPS, preventing SSL stripping and downgrade attacks. A strong HSTS header includes max-age of at least 31536000 (1 year), includeSubDomains, and preload directives. Without HSTS, attackers on the same network can intercept unencrypted connections.

Content-Security-Policy is a powerful header that controls which resources the browser is allowed to load for your page. It prevents XSS attacks by specifying allowed sources for scripts, styles, images, fonts, and other resources. A well-configured CSP dramatically reduces the risk of code injection attacks.

X-Frame-Options prevents your site from being embedded in iframes on other domains, protecting against clickjacking attacks where an attacker overlays invisible frames to trick users into clicking malicious content. Set it to DENY or SAMEORIGIN. The modern replacement is the frame-ancestors directive in CSP.

Referrer-Policy controls how much referrer information is sent when navigating away from your site. A strict policy like 'strict-origin-when-cross-origin' or 'no-referrer' prevents sensitive URL paths and query parameters from leaking to third-party sites, protecting user privacy and session tokens.

Permissions-Policy (formerly Feature-Policy) controls which browser features and APIs your site can use, such as camera, microphone, geolocation, and payment. Restricting unused features reduces the attack surface and prevents malicious scripts from accessing sensitive device capabilities.

Security headers are typically configured at the web server or CDN level. For Nginx, use add_header directives. For Apache, use Header set in .htaccess. For Cloudflare, use Transform Rules or Workers. For Vercel, add headers to vercel.json or next.config.js. Our tool provides exact configuration snippets for each platform.