Security headers checker
Reads the security headers a URL returns and reports each one with a verdict, including the headers that are absent.
Checker offline. Follow the manual steps below, they give the same answer.
What it checks
- Content-Security-Policy, present or absent, enforcing or report-only.
- Strict-Transport-Security, its max-age, and whether subdomains and preload are included.
- X-Frame-Options and CSP frame-ancestors, which supersedes it.
- X-Content-Type-Options, the nosniff value.
- Referrer-Policy and what it leaks to third parties.
- Permissions-Policy, and the older Feature-Policy name.
What is not stored
This checker runs on a server, and the server is not deployed yet, so the form above is disabled. The manual steps on the procedures below return the same answer from your own machine, and they are what the checker automates.
Limits
- A header being present is not the same as it being correct. A CSP with unsafe-inline is present and nearly useless.
- Only the URL you give is read. A login page and an API route on one host often send different headers.
- Nothing on the page is executed, so violations a browser would report are not visible here.
Procedures that explain the result
- How to check CSP header
- How to check if HSTS is enabled
- How to check security headers
- X-XSS-Protection deprecated
Put it on your own page
Link to it with the value filled in, and the checker runs as soon as the page opens.
<a href="https://h2check.org/tools/security-headers/">Security headers checker</a>