Vanorika Technologies

Free tool

Security Headers Checker

Is your website sending the security headers that protect your visitors? Grade it in seconds.

Read-only and passive. We only query public records: no login, no port scanning, no exploitation.

What this checks

  • Fetches your homepage over HTTPS, follows any redirects and records the final URL and HTTP status.
  • Looks for six response headers: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
  • Shows the start of each header value it finds, so you can see what is actually configured.
  • Scores the result as the number of headers present out of six.

Why it matters

Security headers are instructions your server sends to the visitor's browser, and they cost nothing to add. They block whole classes of attack, such as another site loading yours in a hidden frame to trick users into clicking, or a browser treating an uploaded file as a script. For an organisation with a login page, a payment form or a parent portal, missing headers leave defences switched off that the browser already supports.

How to read the result

  • The grade counts presence only. A header that is present but set to a weak value, such as a Content-Security-Policy that allows unsafe-inline everywhere, still counts as present, so read the values shown.
  • If the final URL differs from what you typed, the headers belong to the page you were redirected to, which is usually what visitors see.
  • Strict-Transport-Security and X-Content-Type-Options are the easiest wins. Content-Security-Policy takes the most care because a strict policy can break scripts.
  • A missing X-Frame-Options is acceptable if your Content-Security-Policy sets frame-ancestors, which modern browsers treat as the replacement.

How to fix what it finds

  • Add Strict-Transport-Security: max-age=31536000; includeSubDomains once every subdomain works over HTTPS.
  • Add X-Content-Type-Options: nosniff, X-Frame-Options: DENY (or SAMEORIGIN if you frame your own pages) and Referrer-Policy: strict-origin-when-cross-origin.
  • Start Content-Security-Policy in Content-Security-Policy-Report-Only mode, review what it would block, then enforce it.
  • Set Permissions-Policy to switch off features you never use, for example camera=(), microphone=(), geolocation=().

Want it fixed for you, or tested properly? See what a test would cost or book a free 30 minute call.

Questions people ask

Where do I add security headers on cPanel or shared hosting?

On Apache based hosting you can add them in the .htaccess file in your site root using Header set lines, provided mod_headers is enabled. On Nginx they go in the server block, and on platforms like Vercel or Cloudflare they are set in the project or rules configuration.

Will adding a Content-Security-Policy break my website?

It can, if the policy blocks scripts, fonts or analytics your pages rely on. That is why the safe path is to run it in report-only mode first and tighten it once nothing legitimate is being blocked.

Is X-XSS-Protection still needed?

No. Modern browsers have removed the old XSS filter that header controlled, which is why this tool does not check for it. Content-Security-Policy is the current defence.

Guides for what it finds

Related free tools