HTTP header checker

Paste response headers and check the security basics.

Response headersFrom your browser's network panel or: curl -sI https://example.com

Paste headers only. This tool never contacts your site.

2 of 9 checks passed

Strict-Transport-SecurityPass
Strong, and eligible for the preload list.
Content-Security-PolicyFail
Missing. A CSP is the strongest defence against cross-site scripting.
X-Content-Type-OptionsPass
nosniff is set.
Clickjacking protectionFail
Missing. Add X-Frame-Options: DENY or a CSP frame-ancestors directive.
Referrer-PolicyWarning
Missing. Add strict-origin-when-cross-origin to limit URL leakage.
Permissions-PolicyWarning
Missing. Restrict camera, microphone and geolocation you do not use.
Cross-Origin-Opener-PolicyInfo
Not set. same-origin isolates your window from popups. Optional.
Cross-Origin-Resource-PolicyInfo
Not set. Optional, controls who may embed your resources.
ServerWarning
Reveals a version (nginx/1.25.3). Hide it to make targeted attacks harder.
X-Powered-ByWarning
Reveals the stack (PHP/8.2.12). Remove it.
Cookie sessionWarning
Missing Secure, HttpOnly, SameSite.

Runs in your browser. Nothing you enter is sent anywhere.