Which security headers does your site send?

Security headers are lines a server adds to every response that tell the browser how to treat the page: use HTTPS only, load scripts only from these places, do not let another site frame this page, trust the declared file type, limit what the address reveals to other sites, and keep the camera and microphone off. They cost nothing to send and close the most common ways a small site is hijacked. MDN documents each one.

Six: Strict-Transport-Security, Content-Security-Policy, framing through X-Frame-Options or frame-ancestors, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. Each row shows the value found, whether it is present, weak, or missing, and the exact line to add. The check also requests the plain http:// address once to see whether it redirects to HTTPS, reads a Content-Security-Policy or referrer meta tag in the HTML, and notes Server, X-Powered-By, and X-XSS-Protection when they appear.

The header is sent, but its value does not do the job. Examples the check names: an HSTS max-age under six months, a policy that is report-only, a Content-Security-Policy with 'unsafe-inline' in the script sources and no nonce or hash, a Referrer-Policy of unsafe-url, an obsolete X-Frame-Options: ALLOW-FROM, or the old Feature-Policy name. A weak row gets the same fix line as a missing one.

Copy the lines from the result, or download them as a _headers file for Cloudflare Pages and Netlify, a vercel.json for Vercel, or add_header directives for Nginx. Every line carries what it can change on a working site. Start with the safe ones, X-Content-Type-Options and Referrer-Policy, then HSTS once every subdomain serves HTTPS. Deploy, and check again: results are cached for five minutes, so a fix shows quickly.

Test a Content-Security-Policy as Content-Security-Policy-Report-Only before you enforce it. The suggested line, default-src 'self'; frame-ancestors 'none', blocks every script, style, font, and image from another origin and every inline script, so list the origins and the inline code your pages need, then switch the header name back.

HTTP Strict Transport Security is one header, Strict-Transport-Security: max-age=31536000, that tells a browser to use HTTPS for this host for the next year without asking. Without it, a visitor who types your domain starts on plain HTTP, and a network on the way can serve a changed copy before the redirect. Every site on HTTPS should send it. Browsers read it only over HTTPS, so the redirect from plain HTTP has to exist first, and the check probes that.

includeSubDomains extends the rule to every subdomain, so add it only after each one serves HTTPS. Once a browser has seen the header it refuses plain HTTP for a year, which is the point, and also why a wrong value is slow to undo.

No. Six headers with sound values close a class of browser-side attacks, and that is all the check claims. It reads one response from Cloudflare's network with a plain user agent. It does not run the page, test whether a policy really blocks anything, or scan for vulnerabilities in your code or your dependencies. A CDN, a firewall, or a login page can also answer this check differently from a real visitor.

Yes. No account, no card, no premium plan, no upgrade nag, no hidden paywall. IndieHeaders is free, all of it.

There is no public lookup history. A network check sends the public input needed for that check to its named source. Local file tools process file contents in your browser. Analytics is currently off, so no visit or job data is sent to a tracker. Anything the tool saves for you stays in your browser.