Free Security Headers Checker

Yes — free, no signup, no rate limits. Enter a domain and you get the full graded report. We make one HTTPS request to the URL you enter, read the response headers, and throw the response away. We don't store the URL, the headers, or the result.

Eight security headers: Strict-Transport-Security (HSTS), Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy. It also flags information-disclosure headers — Server with a version number, X-Powered-By, X-AspNet-Version and X-AspNetMvc-Version — and checks whether plain HTTP redirects to HTTPS.

The score starts at 100 and subtracts for each problem, weighted by how much it matters. A missing HSTS or CSP header costs the most, because those two carry most of the real protection. Missing X-Frame-Options or X-Content-Type-Options costs less. A header that's present but weak — a CSP allowing 'unsafe-inline', an HSTS max-age under six months — costs half of what a missing one does. Information disclosure and a missing HTTPS redirect are also penalised. The letter grade is a readable summary of that score, not a standard anyone else uses, so treat the findings as the substance and the grade as the headline.

Because presence isn't the same as correctness, and this is where most header checkers stop being useful. A Content-Security-Policy containing 'unsafe-inline' is present but permits exactly the injected inline scripts CSP exists to block. An HSTS header with max-age=0 actively disables HSTS. An X-Frame-Options of ALLOW-FROM is ignored by every modern browser. The tool reports the specific defect rather than giving credit for the header existing.

The check runs from our server, so it can only reach hosts that are publicly routable. Any hostname resolving to a private, loopback, link-local or carrier-grade NAT address is refused — that restriction stops the tool being used to probe internal networks, including cloud metadata endpoints. For internal hosts, curl -I from inside your network shows the same headers.

Work down by severity. Add Strict-Transport-Security with a max-age of at least six months first — it's a one-line change with no rendering risk. Then X-Content-Type-Options: nosniff and X-Frame-Options: DENY (or a CSP frame-ancestors directive), both similarly safe. Leave Content-Security-Policy for last: it's the highest-value header and the only one that can break your site, so roll it out with Content-Security-Policy-Report-Only first and watch the violation reports before enforcing.

Headers are one signal among many. A site can send a flawless set of headers while running an unpatched framework, exposing a .env file, leaking subdomains through certificate transparency logs, or serving an expired certificate. This tool checks one page, once. Continuous coverage of the rest of your external attack surface is what FortWatch does.

Yes — deliberately. The severity assigned to each header here mirrors the headers scanner in the FortWatch platform, so a header rated medium in this free tool is rated medium in a paid scan. The difference is coverage and continuity, not the rules: the platform checks every asset you own on a schedule and tracks each finding to resolution, rather than checking one URL on demand.