Test Your HTTP Security Headers
Check the security headers your site sends — HSTS, Content-Security-Policy, X-Frame-Options, cookie flags and CORS — and get the exact server config to fix anything missing or misconfigured.
Free instant check · No signup needed · See how it works
What the Security Headers Test Covers
The response headers that harden your site in the browser — where a missing one leaves the door open.
HSTS & Transport
Strict-Transport-Security presence and max-age — forces browsers to use HTTPS and blocks downgrade attacks.
Content-Security-Policy
Whether a CSP is set to control which scripts and resources can load — your main defence against XSS.
Clickjacking Protection
X-Frame-Options / frame-ancestors to stop your site being embedded in a malicious frame.
Cookies & CORS
Secure, HttpOnly and SameSite cookie flags, plus Cross-Origin Resource Sharing configuration.
How It Works
Enter your domain
No agents, no config — just your domain name.
We run the checks
Every check runs concurrently and finishes in under 2 minutes.
Get your grade + fixes
A clear A–F grade with prioritised, step-by-step remediation.
Security Headers Test — FAQ
What is a security headers test?
It inspects the HTTP response headers your site sends and checks whether the key security headers — HSTS, Content-Security-Policy, X-Frame-Options, and secure cookie flags — are present and correctly configured. SecurityStatus tests them free.
Which security headers should every site have?
At minimum: Strict-Transport-Security (HSTS), Content-Security-Policy, X-Frame-Options (or frame-ancestors in CSP), X-Content-Type-Options: nosniff, and Secure/HttpOnly/SameSite cookie flags. The checker flags any that are missing or weak.
What does Content-Security-Policy do?
CSP tells the browser exactly which scripts, styles, and resources are allowed to load, which blocks most cross-site scripting (XSS) and injection attacks. A missing or overly permissive CSP is one of the most common findings.
How do I fix missing security headers?
Headers are set in your web server or CDN config (nginx, Apache, or Cloudflare). The scan links each finding to a guide with the exact config to add for your stack.
Is the security headers check free?
Yes — all security headers are checked free as part of a full domain scan, with a grade and step-by-step fixes. No credit card required.
Test Your Security Headers Now
Find missing HSTS, CSP, and clickjacking protection — and get the exact config to add.
Test My Headers Free